Filtering by: api x clear
enhancement

Improved client certificate process

We improved the client certificate process, enabling you to cancel client certificate orders in an Emailed to Recipient state—orders that are waiting for the email recipient to generate and install the client certificate in one of the supported browsers.

Note: Previously, when a client certificate was in an Emailed to Recipient state, you had to contact support to cancel the order.

Now, if you need to cancel a client certificate order in the Emailed to Recipient state, go to the client certificate's Order details page and in the Certificate Actions dropdown list, select Cancel Order. See Cancel pending client certificate orders.

enhancement

CertCentral Services API: Improved client certificate process
In the DigiCert Services API, we updated the Update order status endpoint enabling you to cancel client certificate orders in a waiting_pickup state—orders that are waiting for the email recipient to generate and install the client certificate in one of the supported browsers.

Note: Previously, when a client certificate was in a waiting_pickup state, you received a forbidden error and had to contact support to cancel the order.

Now, you can use the Update order status endpoint to cancel a client certificate order in the waiting_pickup state.

new

In the DigiCert Services API, we added a new endpoint – Additional emails. This endpoint allows you to update the email addresses that receive certificate notification emails for the order (e.g., certificate renewals, reissues, and duplicate orders).

Note: These people can't manage the order. They only receive certificate related emails.

For more information on the Services API, see our Developers portal.

November 8, 2019

new

We are happy to announce a new addition to the DigiCert Developers portal—Discovery API. We just published our first set of Discovery API endpoints. More will follow as we continue to build out the Discovery API documentation.

Why use it?

  • Access Discovery features without signing into your CertCentral account.
  • Customize the Discovery experience to meet the needs of your organization.
  • Integrate with your existing tools.

Sample of endpoints you can start using now:

Tips and Tricks

  • Discovery API uses this base URL: https://daas.digicert.com/apicontroller/v1/
  • Discovery API requires admin or manager level permissions.
new

In our CertCentral API, we added a new Custom Reports API that leverages the powerful GraphQL query language, enabling you to generate comprehensive and customizable data sets for more robust reporting.

Custom Reports API consolidates multiple REST endpoints into a single one, so you can better define the types and fields in your queries so they return only the information needed. Additionally, use it to create reusable query templates for generating and scheduling reports.

To learn more, see Custom Reports API in our Developers portal.

new

We added two new features to the Expiring Certificates page (in the sidebar, click Certificates > Expiring Certificates), making it easier to manage renewal notifications for your expiring certificates.

First, we added a Renewal Notices column with an interactive check box. Use this check box to enable or disable renewal notices for an expiring certificate.

Second, we added two Renewal Notices filters: Disabled and Enabled. These filters allow you to see only the certificate orders with renewal notices enabled or disabled.

enhancement

In the DigiCert Services API, we updated the List keys and Get key info endpoints response parameters, enabling you to see the organization associated with your ACME certificate orders.

Now, when you call the List keys and Get key info endpoints, we return the name of the organization (organization_name) associated with the ACME certificate order in the response.

Get key info: example reponse with new parameter

new

In the DigiCert Services API, we added two new Order info endpoints. Now, you can use the order ID, the certificate's serial number, or the certificate's thumbprint to view the details for a certificate order.

  • GET https://www.digicert.com/services/v2/order/certificate/{{thumbprint}}
  • GET https://www.digicert.com/services/v2/order/certificate/{{serial_number}}

Currently, these new endpoints only retrieve data for the primary certificate. For more information on the Services API, see our Developers portal.

new

PQC dockerized toolkit guide available now

Secure Site Pro Secure Site Pro certificates come with access to the DigiCert post-quantum cryptographic (PQC) toolkit. To create your own PQC test environment, use one of these options:

Our toolkits contain what you need to create a hybrid SSL/TLS certificate. The hybrid certificate in the toolkits uses a PQC algorithm paired with an ECC algorithm allowing you to test the feasibility of hosting a post-quantum, backwards compatible hybrid certificate on your website.

Note: To access your PQC toolkit, go to your Secure Site Pro Certificate's Order # details page. (In the sidebar menu, click Certificates > Orders. On the Orders page, click the order number link for your Secure Site Pro certificate. On the certificate's order details page, click PQC toolkit.)

To learn more about post-quantum cryptography, see Post-Quantum Cryptography. To learn more about what's included with each Secure Site Pro certificate, see Pro TLS/SSL Certificates.

new

DigiCert is happy to announce we made it easier for DigiCert Accounts using the Retail API to upgrade to our new Certificate Management Platform, DigiCert CertCentralFor free!

To make the upgrade as seamless as possible, we shimmed these Retail API endpoints:

Now, you can upgrade your DigiCert Account without any interruptions to your API integrations. Once you're upgraded, make plans to build new integrations with CertCentral.

  • For more information on the CertCentral Services API, see our Developers portal.

For information about the DigiCert Retail API, see Documentation for the DigiCert Retail API.

enhancement

In Discovery, we updated the Certificates page, adding a new action—Replace certificate—to the Actions dropdown. Now, from the Certificates page, you can replace any certificate with a DigiCert certificate regardless of issuing CA.

(In the sidebar menu, click Discovery > View Results. On the Certificates page, locate the Actions dropdown for the certificate you want to replace. Click Actions > Replace certificate.)

enhancement

In Discovery, we updated the Certificates by rating widget on the Discovery dashboard, making it easier to see the security ratings for your public SSL/TLS certificates (in the sidebar menu, click Discovery > Discovery Dashboard).

As part of the update, we renamed the widget: Certificates analyzed by security rating. Then, we split the chart on the widget into two charts: Public and Others. Now, you can use the Public | Others toggle switch on the widget to select the chart you want to see.

The Certificates analyzed by security rating - Public chart displays the ratings for your public SSL/TLS certificates only. The Certificates analyzed by security rating - Other chart displays the rating for all your other SSL/TLS certificates (e.g., private SSL certificates).

enhancement

In Discovery, we updated the Endpoints and Server details pages making it easier to see the correlation between the IP address and the hostname/FQDN scan it resulted from.

Now, when you configure a scan for a hostname/FQDN, and the scan's endpoint results return IP addresses, we include the hostname/FQDN from the scan with the IP address.

Update note: The hostname update is available in the latest sensor version – 3.7.10. After the sensors updates are completed, rerun scans to see the hostname/IP address correlation on your scan results.

new

In the DigiCert Services API, we added two new endpoints for ordering your Secure Site Pro certificates: Order Secure Site Pro SSL and Order Secure Site Pro EV SSL.

  • POST https://www.digicert.com/services/v2/order/certificate/ssl_securesite_pro
  • POST https://www.digicert.com/services/v2/order/certificate/ssl_ev_securesite_pro

Benefits included with each Secure Site Pro certificate

Each Secure Site Pro certificate includes – at no extra cost – first access to premium feature such as the Post Quantum Cryptographic (PQC) toolkit.

Other benefits include:

  • Priority validation
  • Priority support
  • Two premium site seals
  • Malware check
  • Industry-leading warranties – protection for you and your customer!

To learn more about our Secure Site Pro certificates, see DigiCert Secure Site Pro.

To activate Secure Site Pro certificates for your CertCentral account, contact your account manager or our support team.

enhancement

In the DigiCert Service API, we updated the List reissues endpoint response parameters, enabling you to see the receipt id, how many purchased domains, and how many purchased wildcard domains on the reissued order.

Now, we will return these response parameters, when applicable, in your reissued certificate's order details:

  • receipt_id
  • purchased_dns_names
  • purchased_wildcard_names
Example of the new List reissues endpoint response-parameters

enhancement

We improved the Transaction Summary on the Reissue Certificate for Order pages, allowing you to see how many days remain until the certificate expires. Now, when you reissue a certificate, the Transaction Summary shows the certificate validity along with days until it expires (e.g., 1 year (expires in 43 days).

enhancement

In the DigiCert Services API, we updated the List orders, Order info, List reissues, and List duplicates endpoints enabling you to see how many days remain until the certificate expires. For these endpoints, we return a days_remaining parameter in their responses.

Example of the days_remaining response parameter.png

enhancement

We improved the user invitation workflow for SAML Single Sign-On (SSO) integrations with CertCentral, enabling you to designate invitees as SSO only users before sending your account user invitations. Now, in the Invite New Users popup window, use the SAML Single Sign-on (SSO) only option to restrict invitees to SAML SSO only.

Note: This option disables all other authentication methods for these users. Additionally, this option only appears if you have SAML enabled for your CertCentral account.

(In the sidebar menu, click Account > User Invitations. On the User Invitations page, click Invite New Users. See SAML SSO: Invite users to join your account.)

Simplified enrollment form

We also simplified the SSO only user enrollment form, removing the password and security question requirements. Now, SSO only invitees need to add only their personal information.

new

We made it easier to see your Discovery certificate scan results from the CertCentral Dashboard in your account, adding the Expiring Certificates Discovered, Certificate Issuers, and Certificates Analyzed By Rating widgets.

Each widget contains an interactive chart that allows you drill down to easily find more information about expiring certificates (e.g., which certificates are expiring in 8-15 days), certificates per issuing CA (e.g., DigiCert), and certificates per security rating (e.g., not secure).

More about Discovery

Discovery uses sensors to scan your network. Scans are centrally configured and managed from inside your CertCentral account.

new

In the DigiCert Services API, we updated the Order info endpoint enabling you to see how the certificate was requested. For certificates requested via the Services API or an ACME Directory URL, we return a new response parameter: api_key. This parameter includes the key name along with key type: API or ACME.

Note: For orders requested via another method (e.g., CertCentral account, Guest Request URL, etc.), the api_key parameter is omitted from the response.

Now, when viewing order details, you'll see the new api_key parameter in the response for orders requested via the API or an ACME Directory URL:

GET https://dev.digicert.com/services-api/order/certificate/{order_id}

Response:

Order info endpoint response parameter

new

We added a new search filter – Requested via – to the Orders page that allows you to search for certificate orders requested via a specific API key or ACME Directory URL.

Now, on the Orders page, use the Requested via filter to find active, expired, revoked, rejected, pending reissue, pending, and duplicate certificates requested via a specific API key or ACME Directory URL.

(In the sidebar menu, click Certificates > Orders. On the Orders page, click Show Advanced Search. Then, in the Requested via dropdown select the API Key or ACME Directory URL name or type its name in the box.)

enhancement

We improved our Basic and Secure Site single domain certificate offerings (Standard SSL, EV SSL, Secure Site SSL, and Secure Site EV SSL), adding the Include both [your-domain].com and www. [your-domain].com in the certificate option to these certificates' order, reissue, and duplicate forms. This option allows you to choose whether to include both versions of the common name (FQDN) in these single domain certificates for free.

  • To secure both versions of the common name (FQDN), check Include both [your-domain].com and www. [your-domain].com in the certificate.
  • To secure only the common name (FQDN), uncheck Include both [your-domain].com and www. [your-domain].com in the certificate.

See Order your SSL/TLS certificates.

Works for subdomains too

The new option allows you to get both versions of base and subdomains. Now, to secure both versions of a subdomain, add the subdomain to the Common Name box (sub.domain.com) and check Include both [your-domain].com and www. [your-domain].com in the certificate. When DigiCert issues your certificate, it will include both versions of the subdomain on the certificate: [sub.domain].com and www.[sub.doman].com.

Removed Use Plus Feature for Subdomains

The Include both [your-domain].com and www. [your-domain].com in the certificate option makes the Plus Feature -- Use Plus Feature for Subdomains obsolete. So, we removed the option from the Division Preferences page (in the sidebar menu, click Settings > Preferences).

enhancement

In the DigiCert Services API, we updated the Order OV/EV SSL, Order SSL (type_hint), Order Secure Site SSL, Order Private SSL, Reissue certificate, and Duplicate certificate endpoints listed below. These changes provide more control when requesting, reissuing, and duplicating your single domain certificates, allowing you choose whether to include a specific additional SAN on these single domain certificates for free.

  • /ssl_plus
  • /ssl_ev_plus
  • /ssl_securesite
  • /ssl_ev_securesite
  • /private_ssl_plus
  • /ssl*
  • /reissue
  • /duplicate

*Note: For the Order SSL (type_hint) endpoint, only use the dns_names[] parameter as described below to add the free SAN.

To secure both versions of your domain ([your-domain].com and www. [your-domain].com), in your request, use the common_name parameter to add the domain ([your-domain].com) and the dns_names[] parameter to add the other version of the domain (www. [your-domain].com).

When DigiCert issues your certificate, it will secure both versions of your domain.

example SSL certificte request

To secure only the common name (FQDN), omit the dns_names[] parameter from your request.

enhancement

In the DigiCert Services API, we improved the Duplicate certificate endpoint workflow. Now, if the duplicate certificate can be immediately issued, we return the duplicate certificate in the response body.

For more information, see Duplicate certificate.

enhancement

We improved the duplicate certificate order process in CertCentral. Now, if the duplicate certificate can be immediately issued, we take you directly to the Duplicates page where you can immediately download the certificate.

enhancement

We've updated the documentation links in the CertCentral help menu and on the Account Access page to point to our new documentation portals.

Now, in the CertCentral help menu, when you click Getting Started, we take you to our new DigiCert Documentation Portal. Similarly, when you click Change Log, we take you to our improved Change log page. And now, on the Account Access page (in the sidebar menu, click Account > Account Access), when you click API Documentation, we take you to our new DigiCert Developers Portal.

April 2, 2019

new

We are happy to announce the new DigiCert Documentation Portal. The new site has a modern look and feel and contains streamlined, task-based help documentation, product news, the change log, and API developer documentation.

We are also happy to announce the new DigiCert Developers Portal is out of beta. The developer site has a modern look and feel and contains information about the available endpoints, uses cases, and workflows.

Tips and tricks

  • You can access the documentation portal at www.digicert.com in the top menu under Support (click Support > Documentation).
  • In our documentation, hover on a subheader and click the hashtag icon. This creates a URL in the browser's address bar so you can bookmark or link to specific sections in the instructions.

Coming soon

Get started will contain information to help you get acquainted with the features in your account.

March 18, 2019

fix

In the DigiCert Services API, we fixed a bug in the Order info endpoint where it wasn’t returning the email addresses for an issued client certificate order (Authentication Plus, Email Security Plus, etc.).

Note: When using the List orders endpoint to retrieve information for all issued certificates, the email addresses for client certificate orders were returned.

Now, when you use the Order info endpoint to view the details of an issued an issued client certificate order, the email addresses are returned in the response.

Example Order info response for an Authentication Plus

fix

We fixed an organization unit (OU) entry character limit bug where we were applying the 64 character limit collectively instead of individually to the OU entries on SSL/TLS certificate requests with multiple OUs. When an admin tried to approve the request, they incorrectly received the "Organization units must be less than 64 characters in order to be compliant with industry standards" error message.

Note: This bug only affected requests requiring admin approval.

Now, when an admin approves an SSL/TLS certificate request with multiple OUs (where each entry is within the 64 character limit standard), the request gets submitted to DigiCert as expected.

Compliance Note: Industry standards set a 64 character limit for individual organization unit entries. However, when you add multiple OUs to an order, each one is to be counted individually and not combined. See Publicly Trusted Certificates – Data Entries that Violate Industry Standards.

fix

We fixed a bug on certificate requests where you were unable to edit the division that the request/certificate was assigned to.

Note: Once the certificate was issued, you could go to its Order # details page and edit the division the certificate was assigned to.

Now, when you edit a certificate request, you can change the division the request/certificate is assigned to.

March 12, 2019

fix

We fixed a certificate reissue bug where it appeared that you could revoke a certificate with a pending reissue. To fix this bug, we improved the reissue certificate workflow removing the Revoke Certificate option from certificates with a pending reissue.

Previously, when a certificate had a pending reissue, you could submit a request to revoke the original or previously issued certificate. When the administrator approved the request, the certificate was incorrectly marked as being revoked on the Requests page. However, when you went to the Orders page, the certificate was correctly marked as issued and was still active.

When a certificate has a reissue pending, you can't revoke the certificate as it is tied to the certificate reissue process. If something happens where you need to revoke a certificate with a pending reissue on it, you have two options:

  1. Cancel the certificate reissue and then revoke the original or previously issued certificate.
  2. Wait for DigiCert to reissue the certificate and then revoke the certificate.
fix

We fixed a DigiCert Services API certificate reissue bug where it appeared that you could submit a request to revoke a certificate with a pending reissue. When you use the revoke certificate endpoint, we returned a 201 Created response with the request details.

Now, when you use the revoke certificate endpoint to revoke a certificate with a pending reissue, we return an error with a message letting you know that you can’t revoke an order with a pending reissue along with information on what to do if you need to revoke the certificate.

"An order cannot be revoked while pending reissue. You can cancel the reissue then revoke the certificate, or revoke the certificate once the reissue is complete."

fix

We fixed a DV certificate reissue bug where we weren't honoring the valid until date on the original order for certificates with more than a year remaining until they expired.

Now, when you reissue a DV certificate with more than a year remaining until it expires, the reissued certificate will retain the valid until date of the original certificate.

enhancement

In the DigiCert Services API, we improved the DV certificate request endpoints allowing you to use the new email_domain field along with the existing email field to more precisely set the desired recipients of the domain control validation (DCV) emails.

For example, when ordering a certificate for my.example.com, you can have a domain owner for the base domain (example.com) validate the subdomain. To change the email recipient for the DCV email, in your DV certificate request, add the dcv_emails parameter. Then, add the email_domain field specifying the base domain (example.com) and the email field specifying the email address of the desired DCV email recipient (admin@example.com).

Example request for a GeoTrust Standard DV Certificate

DV certificate endpoints:

enhancement

We enhanced the DigiCert Services API request endpoints enabling you to get faster responses to your certificate requests.

enhancement

We made it easier to Add Contacts for OV certificate orders (Standard SSL, Secure Site SSL, etc.). Now when you order an OV certificate, we populate the Organization Contact card for you. If needed, you can add a technical contact.

  • When adding a CSR that includes an existing organization in your account, we populate the Organization Contact card with the contact assigned to that organization.
  • When you manually add an existing organization, we populate the Organization Contact card with the contact assigned to that organization.
  • When you add a new organization, we populate the Organization Contact card with your contact information.

To use a different organization contact, delete the one populated automatically and manually add one.

enhancement

We made it easier to Add Contacts for EV certificate orders (EV SSL, Secure Site EV SSL, etc.). Now when you order an EV certificate, we will populate the Verified Contact cards for you if EV verified contact information is available in your account. If needed, you can add organization and technical contacts.

  • When adding a CSR that includes an existing organization in your account, we populate the Verified Contact card with the EV verified contacts assigned to that organization.
  • When you manually add an existing organization, we populate the Verified Contact card with the EV verified contacts assigned to that organization.

Assigning Verified Contacts to an organization is not a prerequisite for adding an organization. There may be instances were verified contact information won't be available for an organization. In this case, manually add the Verified Contacts.

February 13, 2019

new

We added two new endpoints that allow you to use the order_id to download the current, active certificate for the order.

These endpoints can only be used to get the most recent reissue certificate for an order. These endpoints won't work for downloading duplicate certificates.

Duplicate Certificates Note

To download a duplicate certificate for an order, first use the List order duplicates endpoint to get the duplicate certificate's certificate_id – GET https://www.digicert.com/services/v2/order/certificate/{{order_id}}/duplicate.

Then use the Get certificate endpoint to download the duplicate certificate – GET https://www.digicert.com/services/v2/certificate/{{certificate_id}}/download/platform .

Reissue Certificates Note

To download a past reissue certificate (one that is not the current reissue), first use the List order reissues endpoint to get the reissue certificate's certificate_id -- GET https://www.digicert.com/services/v2/order/certificate/{{order_id}}/reissue.

Then use the Get certificate endpoint to download the reissue certificate – GET https://www.digicert.com/services/v2/certificate/{{certificate_id}}/download/platform.

API Documentation Note

For more information about these and other endpoints available in the DigiCert Services API, see CertCentral API.

enhancement

We enhanced our RapidSSL DV certificate offerings enabling you to include a second, very specific domain, in these single domain certificates.

  • RapidSSL Standard DV
    By default now, when ordering a RapidSSL Standard DV Certificate, you get both versions of the common name in the certificate – [your-domain].com and www.[your-domain].com.
    After entering the common name, make sure the Include both www.[your-domain].com and [your-domain].com in the certificate box is checked.
    Previously, you had to order separate certificates for [your-domain].com and www.[your-domain].com.
  • RapidSSL Wildcard DV
    By default now, when ordering a RapidSSL Wildcard DV Certificate, you get the wildcard domain and the base domain in the certificate – *.[your-domain].com and [your-domain].com.
    After entering the common name, make sure the Include both *.[your-domain].com and [your-domain].com in the certificate box is checked.
    Previously, you had to order separate certificates for *.[your-domain].com and [your-domain].com.

See the CertCentral: DV Certificate Enrollment Guide.

enhancement

We enhanced the RapidSSL certificate endpoints to include the dns_names parameter, enabling you to include a second, very specific domain, in these single domain certificates.

  • RapidSSL Standard DV
    When ordering a RapidSSL Standard DV Certificate, you may include both version of your domain in the certificate — [your-domain].com and www.[your-domain].com.
    "common_name": "[your-domain].com",
    "dns_names": ["www.[your-domain].com"],

    Previously, you had to order separate certificates for [your-domain].com and www.[your-domain].com.
  • RapidSSL Wildcard DV
    When ordering a RapidSSL Wildcard DV Certificate, you may include the base domain in the certificate — *.[your-domain].com and [your-domain].com).
    "common_name": "*.your-domain.com",
    "dns_names": ["[your-domain].com"],

    Previously, you had to order separate certificates for *.[your-domain].com and [your-domain].com.

For DigiCert Services API documentation, see CertCentral API.

new

Individual Document Signing certificates are available in CertCentral:

  • Document Signing – Individual (500)
  • Document Signing – Individual (2000)

To activate Individual Document Signing certificates for your CertCentral account, contact your Sales representative.

Previously, only Organization Document Signing certificates were available.

  • Document Signing – Organization (2000)
  • Document Signing – Organization (5000)

To learn more about these certificates, see Document Signing Certificate.

enhancement

We enhanced our SSL/TLS and client certificate product offerings, enabling you to set a custom validity period (in days) when ordering one of these certificates. Previously, you could only choose a custom expiration date.

Custom validity periods start on the day we issue the certificate. Certificate pricing is prorated to match the custom certificate length.

Note: Custom certificate lengths can't exceed the industry allowed maximum lifecycle period for the certificate. For example, you can't set a 900-day validity period for an SSL/TLS certificate.

enhancement

We enhanced the SSL/TLS and Client certificate endpoints to include a new validity_days parameter that allows you to set the number of days that the certificate is valid for.

Parameter Priority Note: If you include more than one certificate validity parameter in your request, we prioritize the certificate validity parameters in this order: custom_expiration_date > validity_days > validity_years.

For DigiCert Services API documentation, see CertCentral API.

new

We added a new Order Management - List Order Reissues API endpoint that allows you to view all the reissue certificates for a certificate order. See the List order reissues endpoint.

October 6, 2017

new

Added a new Retrieve Order Validation endpoint; allows you to view the status of DCV and Organization validations for a specific Order.

/services/v2/order/certificate/{order_id}/validation

More details »

October 3, 2017

new

New immediate certificate issuance feature added to the certificate request API endpoints. See CertCentral Immediate Certificate Issuance Feature.

September 26, 2017

new

New feature included in the "help" (?) menu drop-down; added a link to the new Change Log page.

fix

Fixed API bug for the Order Details endpoint. Response body now returns the two renewal fields for client certificates:

"is_renewal": false
"renewed_order_id": 1234567

More details »