January 22, 2020
Discovery: Account setting for discovered certificate renewal notifications
In Discovery, we added a new account setting, Turn on discovered certificate renewal notifications, enabling you to receive renewal notifications for your expiring "discovered" SSL/TLS certificates. These renewal notifications include the option to renew your SSL/TLS certificate with us. When renewing a "discovered" SSL/TLS certificate in CertCentral, we'll replace it with an equivalent DigiCert certificate.
By default, renewal notices for discovered certificates are turned off for a CertCentral account*. To start receiving renewal notices for your expiring discovered certificates, go to Settings > Preferences. In the Certificate Renewal Settings section, check Turn on discovered certificate renewal notifications.
*Note: With the roll out of this new setting, you may need to turn Discovery renewal notifications back on for your account.
To learn more, see Discovery renewal notices.
December 10, 2019
Discovery Cloud-scan service
We've added a new feature to Discovery—Cloud-scan service—that uses a cloud-based sensor to find your public facing SSL/TLS certificates regardless of issuing Certificate Authority (CA).
Discovery Cloud-scan is a free cloud service so there is nothing to install or manage. You can start scanning immediately to find your public SSL/TLS certificates. There is no limit to the number of cloud-based scans you can run.
Cloud-scan runs every 24 hours and use the most recently saved scan configuration. Cloud-scan provides detailed information about the certificates found and the endpoints where those certificates are installed.
Note: This is the open beta for the Cloud-scan service.
To get started, in the left main menu, go to Discovery > Manage Discovery. On the Manage scans page, click Single cloud scan. To learn more, see Discovery Cloud-scan service.
November 21, 2019
Discovery: Renewal notifications for non-DigiCert SSL/TLS certificates
In Discovery, we added renewal notifications for non-DigiCert certificates, making it easier to manage all your SSL/TLS certificates in one place—CertCentral. Now, when Discovery finds non-DigiCert certificates, we'll send renewal notifications for these certificates regardless of issuing Certificate Authority (CA).
Note: When renewing a non-DigiCert SSL/TLS certificate in CertCentral, we'll replace it with the equivalent DigiCert certificate. For example, we'll replace a non-DigiCert single-domain SSL certificate with a DigiCert single-domain SSL certificate.
Who receives these renewal notifications?
By default, Discovery sends renewal notifications for non-DigiCert SSL/TLS certificates to the primary CertCentral administrator—the individual who created the account and receives all account notifications.
We also send renewal notifications to any additional email addresses assigned to receive account notifications. See Set up account email notifications and Certificate renewal notifications.
When are these renewal notifications sent?
Discovery uses your CertCentral renewal notification settings to determine when to send renewal notifications for non-DigiCert certificates. By default CertCentral sends renewal notifications 90, 60, 30, 7, and 3 days before a certificate expires and 7 days after a certificate expires.
To customize your renewal notifications schedule, see Certificate renewal notifications.
Discovery: Customize non-DigiCert SSL/TLS certificate renewal notification process
In Discovery, on the Certificates page, we added three new certificate renewal actions to the Actions column dropdown for non-DigiCert certificates: Disable renewal notices, Enable renewal notices, and Renewal notifications. Renewal notifications allows you to add email addresses to receive renewal notifications for a certificate.
On the Certificates page, you can now update your non-DigiCert certificate renewal process to fit your certificate needs. (In the left main menu, go to Discovery > View Results.)
Note: By default, Discovery sends renewal notifications for all discovered non-DigiCert SSL/TLS certificates.
To customize renewal notifications for non-DigiCert SSL/TLS certificates, see Discovery renewal notices.
November 8, 2019
We are happy to announce a new addition to the DigiCert Developers portal—Discovery API. We just published our first set of Discovery API endpoints. More will follow as we continue to build out the Discovery API documentation.
Why use it?
- Access Discovery features without signing into your CertCentral account.
- Customize the Discovery experience to meet the needs of your organization.
- Integrate with your existing tools.
Sample of endpoints you can start using now:
- List endpoints
- View endpoint rating
- List certificates
- View certificate details
- View certificate rating
- Download certificate
Tips and Tricks
- Discovery API uses this base URL:
https://daas.digicert.com/apicontroller/v1/ - Discovery API requires admin or manager level permissions.
October 28, 2019
In Discovery, we added a new feature—Add root and intermediate CAs—that lets you upload public and private root and intermediate CAs. Use this feature to get more accurate security ratings for certificates chained to them.
If Discovery is unable to locate the root and intermediate CAs for a certificate, it down grades the certificate's security rating. By uploading a copy of the certificate's intermediate and root CAs, the next time Discovery runs a scan that includes that certificate, you'll get a more accurate rating.
Note: Supported certificate formats: .der and .cer
In CertCentral, in the left main menu, click Discovery > Manage Discovery. On the Manage scans page, in the More actions dropdown, click Manage root and intermediate CAs. See Add public and private root and intermediate CAs in our Discovery user guide.
In Discovery, we added a new Blacklist feature that lets you exclude specific IP addresses and FQDNs from your scan results. For example, you may want to blacklist a domain in your CDN network.
Note: When you blacklist an IP address or FQDN, its information is excluded from all future account Discovery scans. This feature does not remove information from existing scan results.
In CertCentral, the left main menu, click Discovery > Manage Discovery. On the Manage scans page, in the More actions dropdown, click Manage blacklist. See Blacklist IP addresses and FQDNs in our Discovery user guide.
July 17, 2019
In Discovery, we added a Scan for configured cipher suites option to the scan settings that lets you see the cipher suites enabled on a server. When adding or editing a scan, this option is located in the Settings section when you select Choose what to scan. See Set up and run a scan or Edit a scan.
Once your scan completes, the cipher suite information is listed on the Server details page, in the Server details section. (In the sidebar menu, click Discovery > View Results. On the Certificates page, click View endpoints. On the Endpoints page, click the endpoint's IP address /FQDN link. Then, on the Server details page, in the Server details section, click the Ciphers View link.)
Update note: The new Scan for configured cipher suites option is available in the latest sensor version – 3.7.7. After sensor updates are complete, edit the scan Settings, select Choose what to scan, check Scan for configured cipher suites, and then rerun the scan.
July 16, 2019
In Discovery, we updated the rating system for Strict-Transport-Security (STS) security headers. Now, we only check STS for HTTP 200 requests and ignore it for HTTP 301 requests. We only penalize the server when the website is missing the Strict-Transport-Security (STS) security header or the setting is wrong. In these cases, we rate the server as "At risk".
Previously, we checked STS for HTTP 301 requests and penalized the server if it was missing the Strict-Transport-Security (STS) security header. In these cases, we rated the server as "Not secure".
To view Security headers results, go to the endpoint's Server details page. In the sidebar menu, click Discovery > View Results. On the Certificates page, click View endpoints. On the Endpoints page, click the endpoint's IP address / FQDN link.
Update note: The updated STS rating system is available in the latest sensor version – 3.7.7. After sensor update is complete, rerun your scans to see your updated STS ratings.
July 2, 2019
We improved the user invitation workflow for SAML Single Sign-On (SSO) integrations with CertCentral, enabling you to designate invitees as SSO only users before sending your account user invitations. Now, in the Invite New Users popup window, use the SAML Single Sign-on (SSO) only option to restrict invitees to SAML SSO only.
Note: This option disables all other authentication methods for these users. Additionally, this option only appears if you have SAML enabled for your CertCentral account.
(In the sidebar menu, click Account > User Invitations. On the User Invitations page, click Invite New Users. See SAML SSO: Invite users to join your account.)
Simplified enrollment form
We also simplified the SSO only user enrollment form, removing the password and security question requirements. Now, SSO only invitees need to add only their personal information.
We made it easier to see your Discovery certificate scan results from the CertCentral Dashboard in your account, adding the Expiring Certificates Discovered, Certificate Issuers, and Certificates Analyzed By Rating widgets.
Each widget contains an interactive chart that allows you drill down to easily find more information about expiring certificates (e.g., which certificates are expiring in 8-15 days), certificates per issuing CA (e.g., DigiCert), and certificates per security rating (e.g., not secure).
More about Discovery
Discovery uses sensors to scan your network. Scans are centrally configured and managed from inside your CertCentral account.
- To activate Discovery for your CertCentral account, contact your account manager or our support team.
- For information about getting Discovery up and running, see Discovery: Install a sensor and run a scan.
In the DigiCert Services API, we updated the Order info endpoint enabling you to see how the certificate was requested. For certificates requested via the Services API or an ACME Directory URL, we return a new response parameter: api_key. This parameter includes the key name along with key type: API or ACME.
Note: For orders requested via another method (e.g., CertCentral account, Guest Request URL, etc.), the api_key parameter is omitted from the response.
Now, when viewing order details, you'll see the new api_key parameter in the response for orders requested via the API or an ACME Directory URL:
GET https://dev.digicert.com/services-api/order/certificate/{order_id}
Response:
We added a new search filter – Requested via – to the Orders page that allows you to search for certificate orders requested via a specific API key or ACME Directory URL.
Now, on the Orders page, use the Requested via filter to find active, expired, revoked, rejected, pending reissue, pending, and duplicate certificates requested via a specific API key or ACME Directory URL.
(In the sidebar menu, click Certificates > Orders. On the Orders page, click Show Advanced Search. Then, in the Requested via dropdown select the API Key or ACME Directory URL name or type its name in the box.)
May 24, 2019
We've added a new tool to our CertCentral portfolio—Discovery—that provides real-time analysis of your entire SSL/TLS certificate landscape.
Designed to quickly find all your internal and public facing SSL/TLS certificates regardless of the issuing Certificate Authority (CA), Discovery identifies problems in certificate configurations and implementations along with certificate-related vulnerabilities or problems in your endpoint configurations.
Note: Discovery uses sensors to scan your network. Sensors are small software applications that you install in strategic locations. Each scan is linked to a sensor.
Scans are centrally configured and managed from inside your CertCentral account. Scan results are displayed in an intuitive and interactive dashboard inside CertCentral. Configure scans to run once or multiple times on a set schedule.
- To activate Discovery for your CertCentral account, contact your account manager or our support team.
- For information about getting Discovery up and running, see Discovery: Install a sensor and run a scan.