Filtern nach: CAA resource record x Löschen
enhancement

CertCentral: Improved DNS Certification Authority Authorization (CAA) resource records checking

DigiCert is happy to announce that we improved the CAA resource record checking feature and error messaging for failed checks in CertCentral.

Now, on the order’s details page, if a CAA resource record check fails, we display the check’s status and include improved error messaging to make it easier to troubleshoot problems.

Background

Before issuing an SSL/TLS certificate for your domain, a Certificate Authority (CA) must check the DNS CAA Resource Records (RR) to determine whether they can issue a certificate for your domain. A Certificate Authority can issue a certificate for your domain if one of the following conditions is met:

  • They do not find a CAA RR for your domain.
  • They find a CAA RR for your domain that authorizes them to issue a certificate for the domain.

How can DNS CAA Resource Records help me?

CAA resource records allow domain owners to control which certificate authorities (CAs) are allowed to issue public TLS certificates for each domain.

Learn more about using DNS CAA resource records

new

CertCentral Services API: Domain locking API endpoints

DigiCert is happy to announce our domain locking feature is now available in the CertCentral Services API.

Note: Before you can use the domain locking endpoints, you must first enable domain locking for your CertCentral account. See Domain locking  – Enable domain locking for your account.

New API endpoints

Updated API endpoints

We updated the response for the Domain info and List domains endpoints to include the following parameters with domain lock details:

  • domain_locking_status (string)
    Domain lock status. Only returned if domain locking is enabled for the account.
  • account_token (string)
    Domain lock account token. Only returned if domain locking is enabled for the account, and if domain locking has been activated for the domain at least once.

To learn more, see:

new

CertCentral: Domain locking is now available

DigiCert is happy to announce our domain locking feature is now available.

Does your company have more than one CertCentral account? Do you need to control which of your accounts can order certificates for specific company domains?

Domain locking allows you to control which of your CertCentral accounts can order certificates for your domains.

How does domain locking work?

DNS Certification Authority Authorization (CAA) resource records allow you to control which certificate authorities can issue certificates for your domains.

With domain locking, you can use this same CAA resource record to control which of your company's CertCentral accounts can order certificates for your domains.

How do I lock a domain?

To lock a domain:

  1. Enable domain locking for your account.
  2. Set up domain locking for a domain.
  3. Add the domain's unique verification token to the domain's DNS CAA resource record.
  4. Check the CAA record for the unique verification token.

To learn more, see:

new

End of life for account upgrades from Symantec, GeoTrust, Thawte or RapidSSL to CertCentral™

From April 5, 2022, MDT, you can no longer upgrade your Symantec, GeoTrust, Thawte, or RapidSSL account to CertCentral™.

If you haven't already moved to DigiCert CertCentral, upgrade now to maintain website security and have continued access to your certificates.

Note: During 2020, DigiCert discontinued all Symantec, GeoTrust, Thawte, RapidSSL admin consoles, enrollment services, and API services.

How do I upgrade my account?

To upgrade your account, contact DigiCert Support immediately. For more information about the account upgrade process, see Upgrade from Symantec, GeoTrust, Thawte, or RapidSSL.

What happens if I don't upgrade my account to CertCentral?

After April 5, 2022, you must get a new CertCentral account and manually add all account information, such as domains and organizations. In addition, you won't be able to migrate any of your active certificates to your new account.

For help setting up your new CertCentral account after April 5, 2022, contact DigiCert Support.

compliance

Anforderungen der Branchenstandards an die Aufnahme der Erweiterung CanSignHttpExchanges in ein ECC-SSL/TLS-Zertifikat:

  • CAA-Ressourceneintrag für die Domäne, die den "cansignhttpexchanges=yes"-Parameter einbezieht*
  • ECC-Schlüsselpaar (Elliptic Curve Cryptography)
  • CanSignHttpExchanges-Erweiterung
  • Maximale Laufzeit 90 Tage*
  • Nur für Signed HTTP Exchange

* Hinweis: Diese Anforderungen gilt ab 1. Mai 2019. Die Erweiterung Signed HTTP Exchange befindet sich in Entwicklung. Im Rahmen der weiteren Entwicklung können sich die Anforderungen noch ändern.

Die Anforderung einer Maximallaufzeit von 90 Tagen für das Zertifikat hat keinen Einfluss auf vor dem 1. Mai 2019 ausgestellte Zertifikate. Bei Zertifikaten, die erneut ausgestellt werden, wird die Laufzeit auf 90 Tage ab dem Zeitpunkt der Neuausstellung gekürzt. Sie können das Zertifikat jedoch weiterhin für die volle bezahlte Laufzeit neuausstellen.

CanSignHttpExchanges-Erweiterung

Vor kurzem fügten wir eine neues Zertifikatsprofil HTTP Signed Exchanges hinzu, um dem AMP-URL-Anzeigeproblem zu begegnen, durch das Ihre Marke nicht in der Adresszeile angezeigt wird. Bessere AMP-URLs mit Signed HTTP Exchange

Dieses neue Profil ermöglicht Ihnen, die CanSignHttpExchanges-Erweiterung in OV- und EV-SSL/TLS-Zertifikate einzubeziehen. Sobald es für Ihr Konto aktiviert ist, wird die Option Einbeziehen der CanSignHttpExchanges-Erweiterung in das Zertifikat auf Ihren OV- und EV-SSL/TLS-Antragsformularen unter Zusätzliche Zertifikatsoptionen angezeigt. Siehe So erhalten Sie Ihr Signed HTTP Exchange-Zertifikat.

Um dieses Zertifikatsprofil für Ihr Konto zu aktivieren, wenden Sie sich an Ihren Kundenbetreuer oder unser Supportteam.