Filtering by: api x clear
new

ICA certificate chain selection for public OV and EV flex certificates

We are happy to announce that public OV and EV certificates with flex capabilities now support Intermediate CA certificate chain selection.

You can add an option to your CertCentral account that enables you to control which DigiCert ICA certificate chain issues your public OV and EV "flex" certificates.

This option allows you to:

  • Set the default ICA certificate chain for each public OV and EV flex certificate.
  • Control which ICA certificate chains certificate requestors can use to issue their flex certificate.

Configure ICA certificate chain selection

To enable ICA selection for your account, contact your account manager or our Support team. Then, in your CertCentral account, on the Product Settings page (in the left main menu, go to Settings > Product Settings), configure the default and allowed intermediates for each type of OV and EV flex certificate.

For more information and step-by-step instructions, see ICA certificate chain option for public OV and EV flex certificates.

new

DigiCert Services API support for ICA certificate chain selection

In the DigiCert Services API, we made the following updates to support ICA selection in your API integrations:

  • Created new Product limits endpoint
    Use this endpoint to get information about the limits and settings for the products enabled for each division in your account. This includes ID values for each product's default and allowed ICA certificate chains.
  • Added support for ICA selection to public TLS OV and EV flex certificate order requests
    After you configure allowed intermediates for a product, you can select the ICA certificate chain that should issue your certificate when you use the API to submit an order request.
    Pass in the ID of the issuing ICA certificate as the value for the ca_cert_id parameter in the body of your order request

Example flex certificate request:

Example flex certificate request

For more information about using ICA selection in your API integrations, see OV/EV certificate lifecycle – (Optional) ICA selection.

enhancement

CertCentral Services API: More versatile revoke certificate endpoint

In CertCentral, we added new Certificate Revocations (API Only) settings that allow you to determine how the revoke certificate endpoint works for your API integration:

  • Revoke an individual certificate (default configuration)
    • Allows you to use this endpoint to revoke a single certificate on an order.
    • Leaves the order active so you can continue issuing certificates on the order.
    • No refunds provided.
  • Revoke order when all certificates are revoked
    • Allows you to use this endpoint to revoke a single certificate on an order.
    • Additionally, if all certificates on the order have been revoked, it will also revoke the order.
    • If eligible, refunds are provided.

To revoke an order and all the certificates on the order, use the revoke order certificates endpoint.

Certificate Revocations (API Only) in CertCentral

To use these new revoke certificate endpoint API settings:

  1. In your CertCentral account, in the left main menu, go to Settings > Preferences.
  2. On the Division Preferences page, expand Advanced Settings.
  3. The new settings are in the Certificate Requests section, under Certificate Revocations (API Only).
new

Multi-year Plans now available

We are happy to announce that Multi-year Plans are now available in CertCentral and CertCentral Partners.

DigiCert® Multi-year Plans allow you to pay a single discounted price for up to six years of SSL/TLS certificate coverage. With Multi-year Plans, you pick the SSL/TLS certificate, the duration of coverage you want (up to six years), and the certificate validity. Until the plan expires, you reissue your certificate at no cost each time it reaches the end of its validity period.

The maximum validity of an SSL/TLS certificate will go from 825 days to 397 days on September 1, 2020. When the active certificate for a Multi-year Plan is about to expire, you reissue the certificate to maintain your SSL/TLS coverage.

compliance

Browser support for TLS 1.0 and 1.1 has ended

The four major browsers no longer support Transport Layer Security (TLS) 1.0 and 1.1.

What you need to know

This change doesn't affect your DigiCert certificates. Your certificates continue to work as they always have.

This change affects browser-dependent services and applications relying on TLS 1.0 or 1.1. Now that browser support for TLS 1.0 and 1.1 has ended, any out-of-date systems will be unable to make HTTPS connections.

What you need to do

If you are affected by this change and your system supports more recent versions of the TLS protocol, upgrade your server configuration as soon as you can to TLS 1.2 or TLS 1.3.

If you do not upgrade to TLS 1.2 or 1.3, your webserver, system, or agent will not be able to use HTTPS to securely communicate with the certificate.

Browser TLS 1.0/1.1 deprecation information

Firefox 78, released June 30, 2020

Safari 13.1, released March 24, 2020

Chrome 84, released July 21, 2020

Edge v84, released 7/16/2020

Helpful resources

With so many unique systems relying on TLS, we can't cover all upgrade paths, but here are a few references that may help:

enhancement

CertCentral Services API: Updated error message documentation

In the Services API documentation, we've updated the Errors page to include descriptions for error messages related to:

  • Immediate DV certificate issuance
  • Domain control validation (DCV)
  • Certificate Authority Authorization (CAA) resource record checks

Earlier this year, we improved the APIs for DV certificate orders and DCV requests to provide more detailed error messages when DCV, file authorization, DNS lookups, or CAA resource record checks fail. Now, when you receive one of these error messages, check the Errors page for additional troubleshooting information.

For more information:

new

Upcoming critical maintenance

On Sunday July 19, 2020 from 07:00 to 09:00 UTC DigiCert will perform critical maintenance.

Although we have redundancies in place to protect your service, some DigiCert services may be unavailable during this time.

DigiCert services will be restored as soon as maintenance is completed.

What can you do?

Please plan accordingly. Schedule high-priority orders, renewals, reissues, and duplicate issues outside of the maintenance window.

enhancement

CertCentral Services API: Improved endpoints

In the DigiCert Services API, we updated the endpoints listed below, enabling you to skip the duplicate organization check to create a new organization.

Default behavior

By default, when you create a new organization (without providing an organization ID), we check the organizations that already exist in your account to avoid creating a duplicate organization. If the details you provide in the request match the details of an existing organization, we associate the order with the existing organization instead of creating a new one.

New organization.skip_duplicate_org_check request parameter

We added a new organization.skip_duplicate_org_check request parameter to the endpoints listed below so that you can override the behavior and force the creation of a new organization.

Example request with new organization.skip_duplicate_org_check request parameter

Example API request with the skip_duplicate_org_check parameter

Updated endpoints:

new

Upcoming Emergency Maintenance

On Sunday June 28, 2020 from 07:00 to 08:00 UTC DigiCert will perform emergency maintenance.

How does this affect me?

During this time, DigiCert will be unable to issue certificates for DigiCert platforms and their corresponding APIs, legacy Symantec consoles and their corresponding APIs, for immediate certificate issuance, and for those using the APIs for automated tasks.

Emergency maintenance affects:

  • CertCentral / Service API
  • Certificate Issuing Service (CIS)
  • Complete Website Security (CWS) / API
  • Direct Cert Portal / API
  • Managed PKI for SSL (MSSL) / API

Services will be restored as soon as maintenance is completed.

What can you do?

Please plan accordingly. Schedule high-priority orders, renewals, reissues, and duplicate issues outside of the maintenance window.

If you use the API for automated tasks, expect interruptions during this time.

enhancement

Legacy account upgrades to CertCentral: Mark migrated certificate orders as renewed

When you migrate a certificate order from your legacy console and then renew it in CertCentral, the original order may not get updated automatically to reflect the renewal. To make it easier to manage these migrated certificates, we added a new option—Mark renewed.

The Mark renewed option allows you to change the certificate order's status to Renewed. In addition, the original migrated certificate no longer appears in expiring or expired certificate lists, in the expiring or expired certificate banners, or on the Expired Certificates page in CertCentral.

Mark a migrated order as renewed

In CertCentral, in the left main menu, go to Certificates > Orders. On the Orders page, in the certificate order's Expires column, click Mark renewed.

Renewed filter

To make it easier to see the migrated certificate orders that have been marked renewed, we added a new filter—Renewed. On the Orders page, in the Status filter dropdown, select Renewed and click Go.

To learn more, see Mark a migrated certificate order as renewed.

enhancement

Legacy API upgrades to CertCentral Services API: Update order status endpoint improvements

When you migrate an order from your legacy console and then renew it in CertCentral, the original order may not get updated automatically to reflect the renewal.

To prevent these "renewed" orders from appearing alongside orders that still need to be renewed, we added a new value—renewed—to the status parameter on the Update order status endpoint.

Now, when you know a migrated certificate order has been renewed, you can manually change the status of the original order to renewed.

Example request with new status parameter

Update order status-endpoint example-request

To learn more, see Update order status.

new

New addition to DigiCert Developers portal

We are happy to announce a new addition to the DigiCert Developers portal—CT log monitoring API. For DigiCert API integrations, use these endpoints to manage the CT log monitoring service that is included with your Secure Site Pro certificate order. See CT log monitoring API.

CT Log Monitoring services

CT log monitoring allows you to monitor the public CT logs for SSL/TLS certificates issued for the domains on your Secure Site Pro certificate order, in near real time.

CT log monitoring is a cloud service so there is nothing to install or manage. After we've issued your Secure Site Pro, and you've turned CT Log monitoring for the order, you can start using the service immediately to monitor the domains on the Secure Site Pro certificate order.

enhancement

CertCentral Services API: Improved order endpoints:

In the DigiCert Services API, we added a "domain ID" response parameter to the endpoints listed below. Now, when you add domains--new or existing--in your certificate request, we return the domain IDs in the response.

This reduces the number of API calls needed to get the domain IDs for the domains on the certificate order. It also allows you to perform domain-related task immediately, such as change the DCV method for one of the domains on the order or resend the WHOIS emails.

Note: Previously, after adding new or existing domains in your certificate request, you had to make an additional call to get the domain IDs: List domains or Domain info.

Updated order endpoints

Example response with new domain ID parameter

Order endpoints' example reponse with new domains parameter

enhancement

CertCentral Services API: Improved Revoke order certificates and Revoke certificate endpoints

In the DigiCert Services API, we updated the Revoke order certificates and Revoke certificate endpoints, enabling you to skip the approval step when revoking a certificate.

Note: Previously, the approval step was required and could not be skipped.

We added a new optional parameter, "skip_approval": true, that allows you to skip the approval step when submitting a request to revoke one certificate or all certificates on an order.

Note: For skip approvals to work for certificate revoke requests, the API key must have admin privileges. See Authentication.

Now, on your revoke certificate and revoke order certificate requests, you can skip the approval step and immediately submit the request to DigiCert for certificate revocation.

Example request for the revoke certificate and revoke order certificates endpoints

Example revoke certificate request with skip_approval parameter

fix

Bug fix: DV certificate issuance emails did not respect certificate format settings

We fixed a bug in the DV certificate issuance process where the Your certificate for your-domain email notification did not deliver the certificate in the format specified in your account settings.

Note: Previously, we included a certificate download link in all DV certificate issued email notifications.

Now, when we issue your DV certificate order, the email delivers the certificate in the format specified in your account's Certificate Format settings.

Configure certificate format for certificate issuance emails

In the left main menu, go to Settings > Preferences. On the Division Preferences page, expand Advance Settings. In the Certificate Format section, select the certificate format: attachment, plain text, or download link. Click Save Settings.

enhancement

Updates to the Domain details page

We simplified the Domain Validation section on the Domain details page to display only two validation types with their expiration dates: OV and EV. We also updated the page to show the domain validation expiration dates calculated from when the Domain Control Verification (DCV) was completed (OV: +825 days, EV: +13 months).

Note: Previously, you could see up to two other validation types: Grid and Private. Grid certificates have the same validity period as OV: 825 days. Domain validation is not required for private certificates as these certificates are not publicly trusted.

To view a domain's validation expiration dates, in the left main menu, go to Certificates > Domains. On the Domains page, locate the domain and click its Domain Name link. On the Domain details page, under Domain Validation, view your domain validations and when they expire.

enhancement

CertCentral Services API: Improved List domains and Domain info endpoints

In the DigiCert Services API, we updated the List domains and Domain info endpoints, enabling you to see when the domain control validations (DCV) for the domain expire: OV and EV validations. This new information is only returned in the response if you include the URL query string include_validation=true.

Now, when you get a list of all domains or information about a specific domain and you include the URL query string include_validation=true, you can see when the DCVs for the domain expire.

Example requests with the URL query string:

  • Domain info
    https://www.digicert.com/services/v2/domain/{{domain_id}}? include_validation=true
  • List domains
    https://www.digicert.com/services/v2/domain?include_validation=true

Example response – domain control validation (DCV) expiration dates

Example response with DCV expiration dates

fix

Removed "Pending" column from Domains page

We found a bug on the Domains page preventing us from providing accurate information about a domain's pending validations. As a temporary solution, we are removing the Pending column from the page until a permanent fix can be deployed.

To view if a domain has pending validations, in the left main menu, go to Certificates > Domains. On the Domains page, locate the domain and click its Domain Name link. On the Domain details page, under Domain Validation, check to see if the domain has pending validations: OV and EV.

February 28, 2020

enhancement

CertCentral Services API: Improved rate limits

In the DigiCert Services API, we improved our requests rate limits. Now, we enforce a rate limit of 1000 requests per 5 minutes, along with a short-term rate limit of 100 requests per 5 seconds to protect against burst requests and prevent abuse*.

*Note: If the number of requests exceeds either rate limit, API access is temporarily blocked, and all requests return a 429 HTTP status code (request_limit_exceeded) with a "Service unavailable, please limit request volume" message.

For more information, see Rate limits.

fix

We fixed a bug in CertCentral where "hidden" organizations prevented certificate request forms from opening. To fix this issue, we no longer include hidden organizations in the list of available organizations on the certificate request forms.

What if I want to add a "hidden" organization to a certificate request?

To include a "hidden" organization in the list of available organizations on your certificate request forms, simply unhide it.

  1. In the left main menu, go to Certificates > Organizations.
  2. On the Organizations page, in the Hidden Organizations dropdown, select Show and then click Go.
  3. Click the organization, you want to unhide.
  4. On the Organization's detail page, click Unhide.

The next time you order a certificate, the organization will appear in the list of available organizations on the certificate request form.

Note: This change only affects the CertCentral user interface (UI). The API supports adding "hidden" organizations to your requests; you don’t need to unhide an organization to add it to a certificate request.

new

Legacy account upgrades to CertCentral

In the DigiCert Service API, we added a new endpoint—DigiCert order ID—to make it easier to find the corresponding DigiCert order IDs for your migrated legacy Symantec orders.

After you migrate your active, public SSL/TLS certificate orders to your new account, we assign a unique DigiCert order ID to each migrated legacy Symantec SSL/TLS certificate order.

Example request

GET https://www.digicert.com/services/v2/oem-migration/{{symc_order_id}}/order-id

Example response
200 OK

Example response for Digicert order ID endpoint

For more information:

new

In the DigiCert Services API, we added four new endpoints for ordering the new more flexible Basic and Secure Site SSL/TLS certificates. These more flexible SSL/TLS certificates make it easier to get the certificate to fit your needs and will replace the old Basic and Secure Site products.

Use these endpoints to place new orders and renewal orders only. They cannot be used to convert existing Basic or Secure Site certificate orders.

To activate any of these new certificates for your CertCentral account, contact your account manager or our Support team.

  • Order Basic OV
    POST https://www.digicert.com/services/v2/order/certificate/ssl_basic
  • Order Basic EV
    POST https://www.digicert.com/services/v2/order/certificate/ssl_ev_basic
  • Order Secure Site OV
    POST https://www.digicert.com/services/v2/order/certificate/ssl_securesite_flex
  • Order Secure Site EV
    POST https://www.digicert.com/services/v2/order/certificate/ssl_ev_securesite_flex

Flexible OV and EV certificates

These certificates provide the encryption and authentication you've come to expect from DigiCert SSL/TLS certificates, while allowing you to build an OV or EV certificate with a mix of whatever domains and wildcard domains* are needed to fit your needs.

*Note: Industry standards support wildcard domains in OV SSL/TLS certificates only. EV SSL/TLS certificates don't support the use of wildcard domains.

fix

CertCentral Services API: Fixed Revoke certificate endpoint bug

In the DigiCert Services API, we fixed a bug in the Revoke certificate endpoint where the request to revoke a single certificate on an order was being submitted for all certificates on the order.

Note: After submitting your "single certificate" revocation request, we returned a 201 Created response with the request details to revoke all certificates on the order.

Now, when using the Revoke certificate endpoint to submit a request to revoke a single certificate on an order, we return a 201 Created response with the request details to revoke just that certificate on the order.

30-day money back guarantee

The Revoke certificate endpoint revokes a certificate on the order and not the order itself. Our 30-day money back guarantee is tied to an order and not a "certificate" on the order. To get the 30-day money back guarantee, you need to revoke the order within the first 30 days; see Revoke order certificates.

Certificate revocation process

All revocation requests, including those made via the Services API, must be approved by an administrator before DigiCert will revoke the certificate. This approval step is required and cannot be skipped or removed from the certificate revocation process.

*What you need to know about the revoke certificate endpoint

This endpoint is designed to revoke a certificate on an order; it doesn't revoke a certificate order.

If you revoke a certificate on an order with only a single certificate:

  • The order is still active
  • No refund is provided for the revoked certificate
  • You can still reissue a certificate on that order

If you don't plan to reissue a certificate for the order, use the Revoke order certificates endpoint to revoke the order.

enhancement

CertCentral Services API: Improved Submit for validation endpoint

In the DigiCert Services API, we updated the Submit for validation endpoint, enabling you to submit a domain for revalidation before it expires. Now, you can submit a domain for revalidation at any time, enabling you to complete the domain’s validation early and maintain seamless certificate issuance for the domain.

Note: If you order a certificate for the domain while the domain's revalidation is in a pending state, we use the domain's current validation to issue the certificate.

New request parameter: dcv_method

We also added a new request parameter, dcv_method*. Now, when you submit a domain for validation, you can change the DCV method used to prove control over the domain.

*Note: This new parameter is optional. If you leave the new parameter out of your request, we return a 204 response with no content. You will need to use the same DCV method used before to prove control over the domain.

Example request with new parameter
POST https://www.digicert.com/services/v2/domain/{{domain_id}}/validation

Submit for validation endpoint example request

Example response when new parameter is included in the request
201 Created

Submit for validation endpoint example response

January 14, 2020

enhancement

CertCentral Services API: Improved order endpoints:

In the DigiCert Services API, we added an "organization ID" response parameter to the endpoints listed below. Now, when you add a new organization in your certificate request, we return the organization's ID in the response, enabling you to use the organization immediately in your certificate requests.

Previously, after adding a new organization in your certificate request, you had to make an additional call to get the new organization's organization ID: Order info.

Updated order endpoints:

Example response with new organization ID parameter

Example response with new organization ID parameter

enhancement

11 SUPPORTED LANGUAGES IN THE DOC AND DEVELOPERS PORTALS

As we work to globalize our product offerings and make our websites, platforms, and documentation more accessible, we are happy to announce that we've added language support to the Document and Developers portals.

We now support these 11 languages:

  • English
  • Chinese (Simplified)
  • Chinese (Traditional)
  • French
  • German
  • Italian
  • Japanese
  • Korean
  • Portuguese
  • Russian
  • Spanish

How does language support work?

When you visit the portals, use the language selector (globe icon) to change the portal display language. We save your language selection for 30 days so you don't need to reselect it every time you visit our documentation site.

TIPS AND TRICKS

Access Doc and Developer portals

You can access the Document and Developers portals from the DigiCert website and CertCentral.

  • From digicert.com
    In the top menu, hover over Support. Under Resources, you can find Documentation and API Documentation links.
  • From CertCentral
    In the Help menu, select Getting Started.
    On the API Keys page, click API Documentation. (In the left main menu, go to Automation > API Keys).

Create links within documentation

You can link to sections within the documentation.

On the documentation page, hover on the subheader you want to link to and click the hashtag icon (#). This creates a URL in the browser's address bar.

Use this feature to bookmark or link to specific sections in the instructions.

enhancement

CertCentral Services API: Improved order Document Signing - Organization (2000) and (5000) endpoints:

In the DigiCert Services API, we updated the Order document signing certificate endpoints for ordering Document Signing - Organization (2000) and (5000) certificates. We added a new parameter, "use_org_as_common_name": true, enabling you to use the organization name as the common name on the certificate.

Note: Previously, your only option was to use the person's full name as the common name on your document signing organization certificates.

Now, if you want to use the organization name as the common name on your document signing organization certificate, add the "use_org_as_common_name": true parameter to your certificate request. When we issue your certificate, the organization name will be the common name on the certificate.

  • Document Signing - Organization (2000) endpoint: https://www.digicert.com/services/v2/order/certificate/document_signing_org_1
  • Document Signing - Organization (5000) endpoint: https://www.digicert.com/services/v2/order/certificate/document_signing_org_2

Example request for Order document signing certificate endpoint

Example Document Signing Organization certificate request

enhancement

Improved client certificate process

We improved the client certificate process, enabling you to cancel client certificate orders in an Emailed to Recipient state—orders that are waiting for the email recipient to generate and install the client certificate in one of the supported browsers.

Note: Previously, when a client certificate was in an Emailed to Recipient state, you had to contact support to cancel the order.

Now, if you need to cancel a client certificate order in the Emailed to Recipient state, go to the client certificate's Order details page and in the Certificate Actions dropdown list, select Cancel Order. See Cancel pending client certificate orders.

enhancement

CertCentral Services API: Improved client certificate process
In the DigiCert Services API, we updated the Update order status endpoint enabling you to cancel client certificate orders in a waiting_pickup state—orders that are waiting for the email recipient to generate and install the client certificate in one of the supported browsers.

Note: Previously, when a client certificate was in a waiting_pickup state, you received a forbidden error and had to contact support to cancel the order.

Now, you can use the Update order status endpoint to cancel a client certificate order in the waiting_pickup state.

new

In the DigiCert Services API, we added a new endpoint – Additional emails. This endpoint allows you to update the email addresses that receive certificate notification emails for the order (e.g., certificate renewals, reissues, and duplicate orders).

Note: These people can't manage the order. They only receive certificate related emails.

For more information on the Services API, see our Developers portal.

November 8, 2019

new

We are happy to announce a new addition to the DigiCert Developers portal—Discovery API. We just published our first set of Discovery API endpoints. More will follow as we continue to build out the Discovery API documentation.

Why use it?

  • Access Discovery features without signing into your CertCentral account.
  • Customize the Discovery experience to meet the needs of your organization.
  • Integrate with your existing tools.

Sample of endpoints you can start using now:

Tips and Tricks

  • Discovery API uses this base URL: https://daas.digicert.com/apicontroller/v1/
  • Discovery API requires admin or manager level permissions.
new

In our CertCentral API, we added a new Custom Reports API that leverages the powerful GraphQL query language, enabling you to generate comprehensive and customizable data sets for more robust reporting.

Custom Reports API consolidates multiple REST endpoints into a single one, so you can better define the types and fields in your queries so they return only the information needed. Additionally, use it to create reusable query templates for generating and scheduling reports.

To learn more, see Custom Reports API in our Developers portal.

new

We added two new features to the Expiring Certificates page (in the sidebar, click Certificates > Expiring Certificates), making it easier to manage renewal notifications for your expiring certificates.

First, we added a Renewal Notices column with an interactive check box. Use this check box to enable or disable renewal notices for an expiring certificate.

Second, we added two Renewal Notices filters: Disabled and Enabled. These filters allow you to see only the certificate orders with renewal notices enabled or disabled.

enhancement

In the DigiCert Services API, we updated the List keys and Get key info endpoints response parameters, enabling you to see the organization associated with your ACME certificate orders.

Now, when you call the List keys and Get key info endpoints, we return the name of the organization (organization_name) associated with the ACME certificate order in the response.

Get key info: example reponse with new parameter

new

In the DigiCert Services API, we added two new Order info endpoints. Now, you can use the order ID, the certificate's serial number, or the certificate's thumbprint to view the details for a certificate order.

  • GET https://www.digicert.com/services/v2/order/certificate/{{thumbprint}}
  • GET https://www.digicert.com/services/v2/order/certificate/{{serial_number}}

Currently, these new endpoints only retrieve data for the primary certificate. For more information on the Services API, see our Developers portal.

new

PQC dockerized toolkit guide available now

Secure Site Pro Secure Site Pro certificates come with access to the DigiCert post-quantum cryptographic (PQC) toolkit. To create your own PQC test environment, use one of these options:

Our toolkits contain what you need to create a hybrid SSL/TLS certificate. The hybrid certificate in the toolkits uses a PQC algorithm paired with an ECC algorithm allowing you to test the feasibility of hosting a post-quantum, backwards compatible hybrid certificate on your website.

Note: To access your PQC toolkit, go to your Secure Site Pro Certificate's Order # details page. (In the sidebar menu, click Certificates > Orders. On the Orders page, click the order number link for your Secure Site Pro certificate. On the certificate's order details page, click PQC toolkit.)

To learn more about post-quantum cryptography, see Post-Quantum Cryptography. To learn more about what's included with each Secure Site Pro certificate, see Pro TLS/SSL Certificates.

new

DigiCert is happy to announce we made it easier for DigiCert Accounts using the Retail API to upgrade to our new Certificate Management Platform, DigiCert CertCentralFor free!

To make the upgrade as seamless as possible, we shimmed these Retail API endpoints:

Now, you can upgrade your DigiCert Account without any interruptions to your API integrations. Once you're upgraded, make plans to build new integrations with CertCentral.

  • For more information on the CertCentral Services API, see our Developers portal.

For information about the DigiCert Retail API, see Documentation for the DigiCert Retail API.

enhancement

In Discovery, we updated the Certificates page, adding a new action—Replace certificate—to the Actions dropdown. Now, from the Certificates page, you can replace any certificate with a DigiCert certificate regardless of issuing CA.

(In the sidebar menu, click Discovery > View Results. On the Certificates page, locate the Actions dropdown for the certificate you want to replace. Click Actions > Replace certificate.)

enhancement

In Discovery, we updated the Certificates by rating widget on the Discovery dashboard, making it easier to see the security ratings for your public SSL/TLS certificates (in the sidebar menu, click Discovery > Discovery Dashboard).

As part of the update, we renamed the widget: Certificates analyzed by security rating. Then, we split the chart on the widget into two charts: Public and Others. Now, you can use the Public | Others toggle switch on the widget to select the chart you want to see.

The Certificates analyzed by security rating - Public chart displays the ratings for your public SSL/TLS certificates only. The Certificates analyzed by security rating - Other chart displays the rating for all your other SSL/TLS certificates (e.g., private SSL certificates).

enhancement

In Discovery, we updated the Endpoints and Server details pages making it easier to see the correlation between the IP address and the hostname/FQDN scan it resulted from.

Now, when you configure a scan for a hostname/FQDN, and the scan's endpoint results return IP addresses, we include the hostname/FQDN from the scan with the IP address.

Update note: The hostname update is available in the latest sensor version – 3.7.10. After the sensors updates are completed, rerun scans to see the hostname/IP address correlation on your scan results.

new

In the DigiCert Services API, we added two new endpoints for ordering your Secure Site Pro certificates: Order Secure Site Pro SSL and Order Secure Site Pro EV SSL.

  • POST https://www.digicert.com/services/v2/order/certificate/ssl_securesite_pro
  • POST https://www.digicert.com/services/v2/order/certificate/ssl_ev_securesite_pro

Benefits included with each Secure Site Pro certificate

Each Secure Site Pro certificate includes – at no extra cost – first access to premium feature such as the Post Quantum Cryptographic (PQC) toolkit.

Other benefits include:

  • Priority validation
  • Priority support
  • Two premium site seals
  • Malware check
  • Industry-leading warranties – protection for you and your customer!

To learn more about our Secure Site Pro certificates, see DigiCert Secure Site Pro.

To activate Secure Site Pro certificates for your CertCentral account, contact your account manager or our support team.

enhancement

In the DigiCert Service API, we updated the List reissues endpoint response parameters, enabling you to see the receipt id, how many purchased domains, and how many purchased wildcard domains on the reissued order.

Now, we will return these response parameters, when applicable, in your reissued certificate's order details:

  • receipt_id
  • purchased_dns_names
  • purchased_wildcard_names
Example of the new List reissues endpoint response-parameters

enhancement

We improved the Transaction Summary on the Reissue Certificate for Order pages, allowing you to see how many days remain until the certificate expires. Now, when you reissue a certificate, the Transaction Summary shows the certificate validity along with days until it expires (e.g., 1 year (expires in 43 days).

enhancement

In the DigiCert Services API, we updated the List orders, Order info, List reissues, and List duplicates endpoints enabling you to see how many days remain until the certificate expires. For these endpoints, we return a days_remaining parameter in their responses.

Example of the days_remaining response parameter.png

enhancement

We improved the user invitation workflow for SAML Single Sign-On (SSO) integrations with CertCentral, enabling you to designate invitees as SSO only users before sending your account user invitations. Now, in the Invite New Users popup window, use the SAML Single Sign-on (SSO) only option to restrict invitees to SAML SSO only.

Note: This option disables all other authentication methods for these users. Additionally, this option only appears if you have SAML enabled for your CertCentral account.

(In the sidebar menu, click Account > User Invitations. On the User Invitations page, click Invite New Users. See SAML SSO: Invite users to join your account.)

Simplified enrollment form

We also simplified the SSO only user enrollment form, removing the password and security question requirements. Now, SSO only invitees need to add only their personal information.

new

We made it easier to see your Discovery certificate scan results from the CertCentral Dashboard in your account, adding the Expiring Certificates Discovered, Certificate Issuers, and Certificates Analyzed By Rating widgets.

Each widget contains an interactive chart that allows you drill down to easily find more information about expiring certificates (e.g., which certificates are expiring in 8-15 days), certificates per issuing CA (e.g., DigiCert), and certificates per security rating (e.g., not secure).

More about Discovery

Discovery uses sensors to scan your network. Scans are centrally configured and managed from inside your CertCentral account.

new

In the DigiCert Services API, we updated the Order info endpoint enabling you to see how the certificate was requested. For certificates requested via the Services API or an ACME Directory URL, we return a new response parameter: api_key. This parameter includes the key name along with key type: API or ACME.

Note: For orders requested via another method (e.g., CertCentral account, Guest Request URL, etc.), the api_key parameter is omitted from the response.

Now, when viewing order details, you'll see the new api_key parameter in the response for orders requested via the API or an ACME Directory URL:

GET https://dev.digicert.com/services-api/order/certificate/{order_id}

Response:

Order info endpoint response parameter

new

We added a new search filter – Requested via – to the Orders page that allows you to search for certificate orders requested via a specific API key or ACME Directory URL.

Now, on the Orders page, use the Requested via filter to find active, expired, revoked, rejected, pending reissue, pending, and duplicate certificates requested via a specific API key or ACME Directory URL.

(In the sidebar menu, click Certificates > Orders. On the Orders page, click Show Advanced Search. Then, in the Requested via dropdown select the API Key or ACME Directory URL name or type its name in the box.)

enhancement

We improved our Basic and Secure Site single domain certificate offerings (Standard SSL, EV SSL, Secure Site SSL, and Secure Site EV SSL), adding the Include both [your-domain].com and www. [your-domain].com in the certificate option to these certificates' order, reissue, and duplicate forms. This option allows you to choose whether to include both versions of the common name (FQDN) in these single domain certificates for free.

  • To secure both versions of the common name (FQDN), check Include both [your-domain].com and www. [your-domain].com in the certificate.
  • To secure only the common name (FQDN), uncheck Include both [your-domain].com and www. [your-domain].com in the certificate.

See Order your SSL/TLS certificates.

Works for subdomains too

The new option allows you to get both versions of base and subdomains. Now, to secure both versions of a subdomain, add the subdomain to the Common Name box (sub.domain.com) and check Include both [your-domain].com and www. [your-domain].com in the certificate. When DigiCert issues your certificate, it will include both versions of the subdomain on the certificate: [sub.domain].com and www.[sub.doman].com.

Removed Use Plus Feature for Subdomains

The Include both [your-domain].com and www. [your-domain].com in the certificate option makes the Plus Feature -- Use Plus Feature for Subdomains obsolete. So, we removed the option from the Division Preferences page (in the sidebar menu, click Settings > Preferences).

enhancement

In the DigiCert Services API, we updated the Order OV/EV SSL, Order SSL (type_hint), Order Secure Site SSL, Order Private SSL, Reissue certificate, and Duplicate certificate endpoints listed below. These changes provide more control when requesting, reissuing, and duplicating your single domain certificates, allowing you choose whether to include a specific additional SAN on these single domain certificates for free.

  • /ssl_plus
  • /ssl_ev_plus
  • /ssl_securesite
  • /ssl_ev_securesite
  • /private_ssl_plus
  • /ssl*
  • /reissue
  • /duplicate

*Note: For the Order SSL (type_hint) endpoint, only use the dns_names[] parameter as described below to add the free SAN.

To secure both versions of your domain ([your-domain].com and www. [your-domain].com), in your request, use the common_name parameter to add the domain ([your-domain].com) and the dns_names[] parameter to add the other version of the domain (www. [your-domain].com).

When DigiCert issues your certificate, it will secure both versions of your domain.

example SSL certificte request

To secure only the common name (FQDN), omit the dns_names[] parameter from your request.

enhancement

In the DigiCert Services API, we improved the Duplicate certificate endpoint workflow. Now, if the duplicate certificate can be immediately issued, we return the duplicate certificate in the response body.

For more information, see Duplicate certificate.

enhancement

We improved the duplicate certificate order process in CertCentral. Now, if the duplicate certificate can be immediately issued, we take you directly to the Duplicates page where you can immediately download the certificate.

enhancement

We've updated the documentation links in the CertCentral help menu and on the Account Access page to point to our new documentation portals.

Now, in the CertCentral help menu, when you click Getting Started, we take you to our new DigiCert Documentation Portal. Similarly, when you click Change Log, we take you to our improved Change log page. And now, on the Account Access page (in the sidebar menu, click Account > Account Access), when you click API Documentation, we take you to our new DigiCert Developers Portal.

April 2, 2019

new

We are happy to announce the new DigiCert Documentation Portal. The new site has a modern look and feel and contains streamlined, task-based help documentation, product news, the change log, and API developer documentation.

We are also happy to announce the new DigiCert Developers Portal is out of beta. The developer site has a modern look and feel and contains information about the available endpoints, uses cases, and workflows.

Tips and tricks

  • You can access the documentation portal at www.digicert.com in the top menu under Support (click Support > Documentation).
  • In our documentation, hover on a subheader and click the hashtag icon. This creates a URL in the browser's address bar so you can bookmark or link to specific sections in the instructions.

Coming soon

Get started will contain information to help you get acquainted with the features in your account.

March 18, 2019

fix

In the DigiCert Services API, we fixed a bug in the Order info endpoint where it wasn’t returning the email addresses for an issued client certificate order (Authentication Plus, Email Security Plus, etc.).

Note: When using the List orders endpoint to retrieve information for all issued certificates, the email addresses for client certificate orders were returned.

Now, when you use the Order info endpoint to view the details of an issued an issued client certificate order, the email addresses are returned in the response.

Example Order info response for an Authentication Plus

fix

We fixed an organization unit (OU) entry character limit bug where we were applying the 64 character limit collectively instead of individually to the OU entries on SSL/TLS certificate requests with multiple OUs. When an admin tried to approve the request, they incorrectly received the "Organization units must be less than 64 characters in order to be compliant with industry standards" error message.

Note: This bug only affected requests requiring admin approval.

Now, when an admin approves an SSL/TLS certificate request with multiple OUs (where each entry is within the 64 character limit standard), the request gets submitted to DigiCert as expected.

Compliance Note: Industry standards set a 64 character limit for individual organization unit entries. However, when you add multiple OUs to an order, each one is to be counted individually and not combined. See Publicly Trusted Certificates – Data Entries that Violate Industry Standards.

fix

We fixed a bug on certificate requests where you were unable to edit the division that the request/certificate was assigned to.

Note: Once the certificate was issued, you could go to its Order # details page and edit the division the certificate was assigned to.

Now, when you edit a certificate request, you can change the division the request/certificate is assigned to.

March 12, 2019

fix

We fixed a certificate reissue bug where it appeared that you could revoke a certificate with a pending reissue. To fix this bug, we improved the reissue certificate workflow removing the Revoke Certificate option from certificates with a pending reissue.

Previously, when a certificate had a pending reissue, you could submit a request to revoke the original or previously issued certificate. When the administrator approved the request, the certificate was incorrectly marked as being revoked on the Requests page. However, when you went to the Orders page, the certificate was correctly marked as issued and was still active.

When a certificate has a reissue pending, you can't revoke the certificate as it is tied to the certificate reissue process. If something happens where you need to revoke a certificate with a pending reissue on it, you have two options:

  1. Cancel the certificate reissue and then revoke the original or previously issued certificate.
  2. Wait for DigiCert to reissue the certificate and then revoke the certificate.
fix

We fixed a DigiCert Services API certificate reissue bug where it appeared that you could submit a request to revoke a certificate with a pending reissue. When you use the revoke certificate endpoint, we returned a 201 Created response with the request details.

Now, when you use the revoke certificate endpoint to revoke a certificate with a pending reissue, we return an error with a message letting you know that you can’t revoke an order with a pending reissue along with information on what to do if you need to revoke the certificate.

"An order cannot be revoked while pending reissue. You can cancel the reissue then revoke the certificate, or revoke the certificate once the reissue is complete."

fix

We fixed a DV certificate reissue bug where we weren't honoring the valid until date on the original order for certificates with more than a year remaining until they expired.

Now, when you reissue a DV certificate with more than a year remaining until it expires, the reissued certificate will retain the valid until date of the original certificate.

enhancement

In the DigiCert Services API, we improved the DV certificate request endpoints allowing you to use the new email_domain field along with the existing email field to more precisely set the desired recipients of the domain control validation (DCV) emails.

For example, when ordering a certificate for my.example.com, you can have a domain owner for the base domain (example.com) validate the subdomain. To change the email recipient for the DCV email, in your DV certificate request, add the dcv_emails parameter. Then, add the email_domain field specifying the base domain (example.com) and the email field specifying the email address of the desired DCV email recipient (admin@example.com).

Example request for a GeoTrust Standard DV Certificate

DV certificate endpoints:

enhancement

We enhanced the DigiCert Services API request endpoints enabling you to get faster responses to your certificate requests.

enhancement

We made it easier to Add Contacts for OV certificate orders (Standard SSL, Secure Site SSL, etc.). Now when you order an OV certificate, we populate the Organization Contact card for you. If needed, you can add a technical contact.

  • When adding a CSR that includes an existing organization in your account, we populate the Organization Contact card with the contact assigned to that organization.
  • When you manually add an existing organization, we populate the Organization Contact card with the contact assigned to that organization.
  • When you add a new organization, we populate the Organization Contact card with your contact information.

To use a different organization contact, delete the one populated automatically and manually add one.

enhancement

We made it easier to Add Contacts for EV certificate orders (EV SSL, Secure Site EV SSL, etc.). Now when you order an EV certificate, we will populate the Verified Contact cards for you if EV verified contact information is available in your account. If needed, you can add organization and technical contacts.

  • When adding a CSR that includes an existing organization in your account, we populate the Verified Contact card with the EV verified contacts assigned to that organization.
  • When you manually add an existing organization, we populate the Verified Contact card with the EV verified contacts assigned to that organization.

Assigning Verified Contacts to an organization is not a prerequisite for adding an organization. There may be instances were verified contact information won't be available for an organization. In this case, manually add the Verified Contacts.

February 13, 2019

new

We added two new endpoints that allow you to use the order_id to download the current, active certificate for the order.

These endpoints can only be used to get the most recent reissue certificate for an order. These endpoints won't work for downloading duplicate certificates.

Duplicate Certificates Note

To download a duplicate certificate for an order, first use the List order duplicates endpoint to get the duplicate certificate's certificate_id – GET https://www.digicert.com/services/v2/order/certificate/{{order_id}}/duplicate.

Then use the Get certificate endpoint to download the duplicate certificate – GET https://www.digicert.com/services/v2/certificate/{{certificate_id}}/download/platform .

Reissue Certificates Note

To download a past reissue certificate (one that is not the current reissue), first use the List order reissues endpoint to get the reissue certificate's certificate_id -- GET https://www.digicert.com/services/v2/order/certificate/{{order_id}}/reissue.

Then use the Get certificate endpoint to download the reissue certificate – GET https://www.digicert.com/services/v2/certificate/{{certificate_id}}/download/platform.

API Documentation Note

For more information about these and other endpoints available in the DigiCert Services API, see CertCentral API.

enhancement

We enhanced our RapidSSL DV certificate offerings enabling you to include a second, very specific domain, in these single domain certificates.

  • RapidSSL Standard DV
    By default now, when ordering a RapidSSL Standard DV Certificate, you get both versions of the common name in the certificate – [your-domain].com and www.[your-domain].com.
    After entering the common name, make sure the Include both www.[your-domain].com and [your-domain].com in the certificate box is checked.
    Previously, you had to order separate certificates for [your-domain].com and www.[your-domain].com.
  • RapidSSL Wildcard DV
    By default now, when ordering a RapidSSL Wildcard DV Certificate, you get the wildcard domain and the base domain in the certificate – *.[your-domain].com and [your-domain].com.
    After entering the common name, make sure the Include both *.[your-domain].com and [your-domain].com in the certificate box is checked.
    Previously, you had to order separate certificates for *.[your-domain].com and [your-domain].com.

See the CertCentral: DV Certificate Enrollment Guide.

enhancement

We enhanced the RapidSSL certificate endpoints to include the dns_names parameter, enabling you to include a second, very specific domain, in these single domain certificates.

  • RapidSSL Standard DV
    When ordering a RapidSSL Standard DV Certificate, you may include both version of your domain in the certificate — [your-domain].com and www.[your-domain].com.
    "common_name": "[your-domain].com",
    "dns_names": ["www.[your-domain].com"],

    Previously, you had to order separate certificates for [your-domain].com and www.[your-domain].com.
  • RapidSSL Wildcard DV
    When ordering a RapidSSL Wildcard DV Certificate, you may include the base domain in the certificate — *.[your-domain].com and [your-domain].com).
    "common_name": "*.your-domain.com",
    "dns_names": ["[your-domain].com"],

    Previously, you had to order separate certificates for *.[your-domain].com and [your-domain].com.

For DigiCert Services API documentation, see CertCentral API.

new

Individual Document Signing certificates are available in CertCentral:

  • Document Signing – Individual (500)
  • Document Signing – Individual (2000)

To activate Individual Document Signing certificates for your CertCentral account, contact your Sales representative.

Previously, only Organization Document Signing certificates were available.

  • Document Signing – Organization (2000)
  • Document Signing – Organization (5000)

To learn more about these certificates, see Document Signing Certificate.

enhancement

We enhanced our SSL/TLS and client certificate product offerings, enabling you to set a custom validity period (in days) when ordering one of these certificates. Previously, you could only choose a custom expiration date.

Custom validity periods start on the day we issue the certificate. Certificate pricing is prorated to match the custom certificate length.

Note: Custom certificate lengths can't exceed the industry allowed maximum lifecycle period for the certificate. For example, you can't set a 900-day validity period for an SSL/TLS certificate.

enhancement

We enhanced the SSL/TLS and Client certificate endpoints to include a new validity_days parameter that allows you to set the number of days that the certificate is valid for.

Parameter Priority Note: If you include more than one certificate validity parameter in your request, we prioritize the certificate validity parameters in this order: custom_expiration_date > validity_days > validity_years.

For DigiCert Services API documentation, see CertCentral API.

new

We added a new Order Management - List Order Reissues API endpoint that allows you to view all the reissue certificates for a certificate order. See the List order reissues endpoint.

October 6, 2017

new

Added a new Retrieve Order Validation endpoint; allows you to view the status of DCV and Organization validations for a specific Order.

/services/v2/order/certificate/{order_id}/validation

More details »

October 3, 2017

new

New immediate certificate issuance feature added to the certificate request API endpoints. See CertCentral Immediate Certificate Issuance Feature.

September 26, 2017

new

New feature included in the "help" (?) menu drop-down; added a link to the new Change Log page.

fix

Fixed Submit Orders Endpoints for Client Certificates

In the CertCentral API, the Submit Orders endpoints, which allow you to automatically or manually renew certificates, has been updated. This change affects client certificate orders and client certificate renewal orders. For more information, see our DigiCert Services API documentation.

Client Certificate Orders:

On a client certificate order, the "is_renewed" value is properly included in the returned response body.

  • If the order has not been renewed, the "is_renewed" field is false.
    "is_renewed": false,
  • If the order has been renewed, the "is_renewed" field is true.
    "is_renewed": true,

CertCentral API - Client Certificate Renewals

These changes only apply to client certificate renewals that are manually triggered; it does not not apply to those triggered by the auto-renew functionality.

POST

When using the CertCentral API to place a client certificate renewal request, you add the following parameter to the Endpoint: POST /order/certificate/{order_id} body:"renewal_of_order_id": "1234567"

GET

Now, when you view the new order (the renewal of the original expiring certificate order), the two renewal fields are in the returned response body:"is_renewed": true,
"renewed_order_id": 1234567,

The "renewed_order_id" is the order id of the original order you renewed.