When a trust anchor certificate is locked, an account user cannot approve or reject pending approval certificates, and cannot suspend, unsuspend, update the trust anchor certificate.
To lock a trust anchor certificate:
Sign in to DigiCert ONE.
Select the Manager menu (top right) > Software Trust.
Navigate to: Account > Trust anchor certificates.
Hover over the trust anchor certificate alias that you want to activate.
Click the lock icon that appears to the right of the certificate alias.