Filtering by: request forms x clear
fix

We fixed a bug where new organizations added during the SSL/TLS certificate request process weren't listed on the Organizations page (in the sidebar menu, click Certificates > Organizations).

With this fix, new organizations added during the SSL/TLS certificate request process will now be automatically listed on the Organizations page in your account.

Retroactive fix: All Organizations will be listed

The fix for this bug is retroactive too. If you've enabled users to add new organizations during the request process, the next time you go to the Organizations page in your account, these organizations will be added to the list.

Note: This bug didn't affect your ability to request additional SSL/TLS certificates for these organizations, as they appeared in the list of existing organizations on the certificate request forms where you could add them to the certificate. This bug also didn't affect organizations added from the New Organizations page (on the Organizations page, click New Organization).

enhancement

We improved the CertCentral audit logs, making it easier to track API key creations. Now, the audit logs will contain information about who created the API key, when it was created, name of API, etc.

(To access the audit logs in your account, in the sidebar menu, click Account > Audit Logs.)

new

We've added a new certificate profile option, OCSP Must-Staple, that allows you to include the OCSP Must-Staple extension in OV and EV SSL/TLS certificates. Once enabled for your account, the Include the OCSP Must-Staple extension in the certificate option appears on your SSL/TLS certificate request forms under Additional Certificate Options.

Note: Browsers with support for OCSP must-staple may display a blocking interstitial to users accessing your site. Ensure that your site is configured to properly and robustly serve stapled OCSP Responses before installing the certificate.

To enable a certificate profile for your account, reach out to your account representative or contact our Support team.

Other available certificate profile options

If enabled for your account, these profile options appear on your SSL/TLS certificate request forms under Additional Certificate Options.

  • Intel vPro EKU
    Allows you to include the Intel vPro EKU field in OV SSL/TLS certificates.
  • KDC/SmartCardLogon EKU
    Allows you to include the KDC/SmartCardLogon EKU (Extended Key Usage) field in OV SSL/TLS certificates.
  • HTTP Signed Exchange
    Allows you to include the CanSignHTTPExchanges extension in OV and EV SSL/TLS certificate (see Improve your AMP URLs with Signed HTTP Exchange).
  • Delegated Credentials
    Allows you to include the DelegationUsage extension in OV and EV SSL/TLS certificates.
new

We've added a new certificate profile option, Delegated Credentials, that allows you to include the DelegationUsage extension in OV and EV SSL/TLS certificates. Once enabled for your account, the Include the DelegationUsage extension in the certificate option appears on your SSL/TLS certificate request forms under Additional Certificate Options.

To enable a certificate profile for your account, reach out to your account representative or contact our Support team.

Background

The Delegated Credentials for TLS extension is under active development within the Internet Engineering Task Force (IETF). In order to support interoperability testing, we’ve added the ability to issue certificates compliant with the current draft specification. Note that there may be multiple changes to the draft as industry development continues.

Other available certificate profile options

If enabled for your account, these profile options appear on your SSL/TLS certificate request forms under Additional Certificate Options.

  • Intel vPro EKU
    Allows you to include the Intel vPro EKU field in an OV SSL/TLS certificate.
  • KDC/SmartCardLogon EKU
    Allows you to include the KDC/SmartCardLogon EKU (Extended Key Usage) field in an OV SSL/TLS certificate.
  • HTTP Signed Exchange
    Allows you to include the CanSignHTTPExchanges extension in an OV and EV SSL/TLS certificate (see Improve your AMP URLs with Signed HTTP Exchange).
  • OCSP Must-Staple
    Allows you to include the OCSP Must-Staple extension in OV and EV SSL/TLS certificates.
enhancement

We improved the Transaction Summary on the certificate request pages, making it easier to track the cost of the certificate. For example, you request a Multi-Domain certificate and add 5 domains. In the Transaction Summary, we show the base price (which includes 4 SANs) plus the price of the additional SAN added to the order.

Previously, the Transaction Summary only tracked the total cost of the certificate without the itemized cost.

new

We added a new feature Allow users to add new contacts when requesting TLS certificates that provides you with the flexibility to choose whether standard users, finance managers, and limited users can add a new non-CertCentral account user as a Verified Contact (for EV) when ordering an EV TLS/SSL certificate from inside their account or when using a guest URL.

Previously, the only way to prevent these user roles from adding a new non-CertCentral account user as a verified contact during the order process was to edit the request and select an existing contact for the order or reject the certificate request.

Now, you can control whether the User, Finance Manager, and Limited User roles can add a new non-CertCentral account user as a verified contact from the EV SSL/TLS certificate request pages. This feature doesn't remove the option from the EV SSL/TLS certificate order pages for the Administrator and Manager roles.

On the Division Preferences page (Settings > Preferences). In the Certificate Request section (expand Advanced Settings), under Add New Contacts, uncheck Allow users to add new contacts when requesting TLS certificates and then click Save Settings.

Note: This change does not remove the ability to add an existing contact (CertCentral account users or non-CertCentral account users) as the verified contact to an order as this is required for all EV SSL/TLS certificate orders.

enhancement

We enhanced the Allow users to add new organizations when requesting TLS certificate feature providing you with the flexibility to choose whether standard users, finance managers, and limited users can add a new organization when ordering a TLS certificate (OV and EV) from inside their account or when using a guest URL.

Previously, the feature removed the ability to add a new organization for all user roles: Administrator, Manager, Standard User, Finance Manager, and Limited User.

Now, the Allow users to add new organizations when requesting TLS certificate feature only affects the User, Finance Manager, and Limited User roles ability to add new organizations from the certificate request pages. Administrator and Manager roles retain the ability to add new organizations whether this feature is enabled or disabled.

On the Division Preferences page (Settings > Preferences). In the Certificate Request section (expand Advanced Settings), under Add New Organization, uncheck Allow users to add new organizations when requesting TLS certificates and then click Save Settings.

Note: This change does not remove the ability to add an existing, pre-validated organization to an order as this is required for all OV and EV TLS certificate orders.

enhancement

We enhanced our SSL/TLS and client certificate product offerings, enabling you to set a custom validity period (in days) when ordering one of these certificates. Previously, you could only choose a custom expiration date.

Custom validity periods start on the day we issue the certificate. Certificate pricing is prorated to match the custom certificate length.

Note: Custom certificate lengths can't exceed the industry allowed maximum lifecycle period for the certificate. For example, you can't set a 900-day validity period for an SSL/TLS certificate.

enhancement

We enhanced the SSL/TLS and Client certificate endpoints to include a new validity_days parameter that allows you to set the number of days that the certificate is valid for.

Parameter Priority Note: If you include more than one certificate validity parameter in your request, we prioritize the certificate validity parameters in this order: custom_expiration_date > validity_days > validity_years.

For DigiCert Services API documentation, see CertCentral API.

new

We added a new Order Management - List Order Reissues API endpoint that allows you to view all the reissue certificates for a certificate order. See the List order reissues endpoint.

enhancement

We enhanced the add existing organization feature of the TLS/SSL certificate order process, enabling you to see the organization's address and phone number, along with its validation status (EV Validated, Pending OV Validated, etc.). Note that organizations not yet submitted for validation won't have any validation status listed.

Previously, you were unable to see any information about the organization from the Request Certificate pages. To view organization details and validation status, you had to visit the Organizations page (in the sidebar menu, click Certificates > Organizations).

Note: If you have more than nine active organizations in your account, you will still use the Organization drop-down list, and you will still need to visit the Organizations page to view details about an organization. However, you will now see the top two most used organizations at the top of the list under Recently Used.

enhancement

Enhancements made to client certificates. When ordering a client certificate (Premium, Email Security Plus, Digital Plus, and Authentication Plus), you may now include a Custom Expiration Date for your client certificates.

Previously when ordering a client certificate, you were only able to select 1, 2, or 3 years for the certificate's validity period.