Change log: 2021

We are happy to announce the CertCentral Report Library is now available for CertCentral Enterprise and CertCentral Partner.* The Report Library is a powerful reporting tool that allows you to download more than 1000 records at a time. Use the Report Library to build, schedule, organize, and export reports to share and reuse.

The Report Library includes six customizable reports: Orders, Organizations, Balance history, Audit log, Domains, and Fully qualified domain names (FQDN). When building reports, you control the details and information that appear in the report, configure the columns and column order, schedule how often you want the report to run (once, weekly, or monthly), and choose the report format (CSV, JSON, or Excel). In addition, you receive notices when the report is ready for download in your account.

We're pleased to announce the release of the CertCentral Report Library API! This new API service makes it possible to leverage key features of the Report Library in your CertCentral API integrations, including building reports and downloading report results*.

See our Report Library API documentation to learn more about including the Report Library in your API integrations.

We updated our unique organization name check to include the assumed name (doing business as name) when creating an organization.

Now, when you create an organization, we include the assumed name in the unique organization check. Therefore, you can create organizations with the same name, as long as each organization has a unique assumed name.

For example:

Creating organizations

In CertCentral and the CertCentral Services API, you can create an organization to submit for prevalidation or when you order a TLS/SSL certificate. This change applies to both processes.

To remain compliant with industry standards, DigiCert had to replace the intermediate CA (ICA) certificate used to issue CertCentral client certificates.

CertCentral client certificate profiles that used the DigiCert SHA2 Assured ID CA intermediate CA certificate now use the DigiCert Assured ID Client CA G2 intermediate CA certificate. This change also changes the root certificate from DigiCert Assured ID Root CA to DigiCert Assured ID Root G2.

Old ICA and root certificates

New ICA and root certificates

For more information, see DigiCert ICA Update. To download a copy of the new intermediate CA certificate, see DigiCert Trusted Root Authority Certificates.

Do you still need your client certificate to chain to the DigiCert Assured ID Root CA certificate? Contact your account representative or DigiCert Support.

DigiCert will perform scheduled maintenance on December 4, 2021, between 22:00 – 24:00 MST (December 5, 2021, between 05:00 – 07:00 UTC). Although we have redundancies to protect your service, some DigiCert services may be unavailable during this time.

To comply with new industry standards for the file-based domain control validation (DCV) method, you can only use the file-based DCV to demonstrate control over fully qualified domain names (FQDNs), exactly as named.

To learn more about the industry change, see Domain validation policy changes in 2021.

How does this affect me?

As of November 16, 2021, you must use one of the other supported DCV methods, such as Email, DNS TXT, and CNAME, to:

To learn more about the supported DCV method for DV, OV, and EV certificate requests:

Pending certificate request

If you have a pending certificate request with incomplete file-based DCV checks, you may need to switch DCV methods* or use the file-based DCV method to demonstrate control over every fully qualified domain name, exactly as named, on the request.

To learn more about the supported DCV methods for DV, OV, and EV certificate requests:

Domain prevalidation

If you plan to use the file-based DCV method to prevalidate an entire domain or entire subdomain, you must use a different DCV method.

To learn more about the supported DCV methods for domain prevalidation, see Supported domain control validation (DCV) methods for domain prevalidation.

If you use the CertCentral Services API to order certificates or submit domains for prevalidation using file-based DCV (http-token), this change may affect your API integrations. To learn more, visit File-based domain control validation (http-token).

DigiCert will perform scheduled maintenance on November 6, 2021, between 22:00 – 24:00 MDT (November 7, 2021, between 04:00 – 06:00 UTC).

On October 2, 2021, between 22:00 – 24:00 MDT (October 3, 2021, between 04:00 – 06:00 UTC), DigiCert will perform scheduled maintenance.

On September 11, 2021, between 22:00 – 24:00 MDT (September 12, 2021, between 04:00 – 06:00 UTC), DigiCert will perform scheduled maintenance.

To make it easier to maintain active validation for domains in your account, we added new filters, response fields, and a new endpoint to our domain management APIs. With these updates, you can:

We created a new endpoint to make it easier to get certificate order details using alternative order IDs: Get orders by alternative order ID. This endpoint returns the order ID, certificate ID, and order status of certificate orders with the alternative_order_id you provide in the URL path.

We fixed a bug that changes the reissue workflow for DV certificates. After August 24, 2021, when you reissue a DV certificate and change or remove SANs, the original certificate and any previously reissued or duplicate certificates are revoked after a 72-hour delay.

We updated the behavior for products that can use wildcard domain names and fully qualified domain names (FQDNs) in a certificate. After August 23, 2021 certificates including the wildcard domain name will only secure the FQDN and all of its same-level domain names without charge.

Subject Alternative Names (SANs) that are not at the same level as the wildcard domain name will be considered additional to the wildcard coverage. For example, a wildcard certificate for *.digicert.com will only allow FQDNs like one.digicert.com, two.digicert.com, and three.digicert.com to be included as SANs in the certificate without charge.

On August 7, 2021, between 22:00 – 24:00 MDT (August 8, 2021, between 04:00 – 06:00 UTC), DigiCert will perform scheduled maintenance. Although we have redundancies to protect your service, some DigiCert services may be unavailable during this time.

What can I do?

Plan accordingly:

Services will be restored as soon as we complete the maintenance.

Verified Mark Certificates (VMCs) are a new type of certificate that allow companies to place a certified brand logo next to the “sender” field in customer inboxes—visible before the message is opened—acting as confirmation of your domain’s DMARC status and your organization’s authenticated identity. Learn more about VMC certificates.

To disable or change availability of VMC in your account, visit the Product Settings page.

To help you manage your Verified Mark Certificate (VMC) orders in your API integrations, we’ve made the following updates to the CertCentral Services API.

New endpoints:

Updated endpoints:

To learn more about managing VMC certificates from your API integrations, visit Verified Mark Certificate workflow.

On July 10, 2021, between 22:00 – 24:00 MDT (July 11, 2021, between 04:00 – 06:00 UTC), DigiCert will perform scheduled maintenance.

During maintenance, for approximately 60 minutes, the services specified below under Service downtime will be down. Due to the scope of the maintenance, the services specified below under Service interruptions may experience brief interruptions during a 10-minute window.

On June 5, 2021, between 22:00 – 24:00 MDT (June 6, 2021, between 04:00 – 06:00 UTC), DigiCert will perform scheduled maintenance. Although we have redundancies to protect your service, some DigiCert services may be unavailable during this time.

To make it easier to see how the Services API groups the domains on your OV/EV TLS certificate orders for validation, we added a new response parameter to the endpoints for submitting certificate order requests: domains[].dns_name.*

The dns_name parameter returns the common name or SAN of the domain on the order. To prove you control this domain, you must have an active validation for the domain associated with the domains[].name and domains[].id key/value pairs.

Example OV certificate order

{
    "certificate": {
        "common_name": "subl.example.net",
        "dns names" : [
            "sub2.subl.example.net",
            "sub3.sub2.subl.example.net"
        ],
        "esr": ({csr}}
    },
    "organiation": {
        "id": ((organization id}}
    },
    "dev method": "email",
    "order validity": {
        "years": 1
    }
}

{
    "id": 137368217,
    "domains": [
        {
            "id": 3530297,
            "name": "example.net",
             "dns name" : "subl.example.net"
        },
        {
            "id": 3530297,
            "name": "example.net",
            "dns name" : "sub2.subl.example.net"
        },
        {
            "id": 3530297,
            "name": "example.net",
            "dns name": "sub3.sub2.subl.example.net"
        }
    ],
    "certificate id": 138305304
}

The Services API returns the domains[].dns_name parameter in the JSON response for the following endpoints:

Starting May 27, 2021, to comply with new industry standards for code signing certificates, DigiCert will make the following changes to our code signing certificate process.

See Appendix A in the Baseline Requirements for the Issuance and Management of Publicly-Trusted Code Signing Certificates to learn more about these industry changes,

We fixed a bug that allowed site seals to display on fully-qualified domain names (FQDN) that were not included in the certificate. Now, seals only display when there is an exact FQDN match.

On May 1, 2021, between 22:00 – 24:00 MDT (May 2, 2021, between 04:00 – 06:00 UTC), DigiCert will perform scheduled maintenance.

For up to 10 minutes total during the 2-hour window, we will be unable to issue certificates for the DigiCert platforms, their corresponding APIs, immediate certificate issuance, and those using the APIs for other automated tasks.

To make it easier to get a comprehensive validation status for your domains, DigiCert is deprecating the status parameter in the Domain info response. To ensure you are getting complete and accurate status information for each different validation type on your domains, you should use the validations array when you call the Domain info endpoint from your API integrations instead.

{
...
  "validations": [
    {
      "type": "ov",
      "name": "OV",
      "description": "Normal Organization Validation",
      "validated_until": "2023-07-31T14:51:31+00:00",
      "status": "active",
      "dcv_status": "complete"
    },
    {
      "type": "ev",
      "name": "EV",
      "description": "Extended Organization Validation (EV)",
      "validated_until": "2022-05-27T14:51:31+00:00",
      "status": "active",
      "dcv_status": "complete"
    }
  ],
...
}

To help you manage your site seals in your API integrations, we’ve made the following updates to the CertCentral Services API:

To make it easier to manage certificates from your API integrations, we updated the Revoke certificate endpoint path to accept the certificate ID or the serial number of the certificate to revoke. Previously, the Revoke certificate endpoint path only accepted the certificate ID.

Learn more about using the Revoke certificate endpoint

We are happy to announce the release of our new site seal, the DigiCert Smart Seal. The new Smart Seal works with your Secure Site Pro and Secure Site TLS certificates to provide your customers with the assurance that your website is secured by DigiCert—one of the most recognized names in TLS/SSL security.

To make the Smart Seal more interactive and engaging, we added a hover-over effect, animation, and the ability to display your company logo in the hover-over effect and animation feature.

On April 3, 2021, between 22:00 – 24:00 MDT (April 4, 2021, between 04:00 – 06:00 UTC), DigiCert will perform scheduled maintenance.

During maintenance, for up to 10 minutes, we will be unable to issue certificates for the DigiCert platforms, their corresponding APIs, immediate certificate issuance, and those using the APIs for other automated tasks.

On March 20, 2021, between 18:00 – 24:00 MST (March 21, 2021, between 00:00 – 06:00 UTC), DigiCert will perform critical maintenance on PKI Platform 8. During maintenance, the PKI Platform 8 and its corresponding API will be down for approximately six hours.

We are happy to announce that we are using a new purchase order and invoice system in CertCentral. We've made several changes to make it easier for you to manage your purchase orders and invoices.

The next time you sign in to CertCentral, you will see two new menu options under Finances: Pay Invoice and Purchase Orders and Invoices. Additionally, we now send all invoice emails from our new invoice system.

To help you track financial data in your API integrations, we updated the View balance endpoint to return the following data:

For more information, see the documentation for the View balance endpoint.

{
    "balance": "454.00",
    "currency": "USD",
    "unpaid_invoice_balance": "0.00",
    "negative_balance_limit": "2000.00",
    "used_credit_from_other_containers": "0.00",
    "total_available_funds": "2454.00"
}

We are happy to announce that the CertCentral Services API now supports automatic certificate reissue requests (auto-reissue) for Multi-year Plans. The auto-reissue feature makes it easier to maintain SSL/TLS coverage on your Multi-year Plans.

You can enable auto-reissue for individual orders in your CertCentral account. When auto-reissue is enabled, we automatically create and submit a certificate reissue request 30 days before the most recently issued certificate on the order expires.

{
    ...
    "auto_renew": 1,
    "auto_reissue": 1,
    ...
}

We are happy to announce that select public DV certificates now support Intermediate CA certificate chain selection:

You can add a feature to your CertCentral account that enables you to control which DigiCert ICA certificate chain issues the end-entity certificate when you order these public DV products.

This feature allows you to:

In the DigiCert Services API, we made the following updates to support ICA selection in your DV certificate order requests:

Pass in the issuing ICA certificate's ID as the value for the ca_cert_id parameter in your order request's body.

{
    "certificate": {...},
    "order_validity": {
        "years": 6
    },
    "ca_cert_id": "DF3689F672CCB90C"
    ...
}

For more information about using ICA selection in your API integrations, see DV certificate lifecycle – Optional ICA selection.

On March 6, 2021, between 22:00 – 24:00 MST (March 7, 2021, between 05:00 – 07:00 UTC), DigiCert will perform scheduled maintenance.

Although we have redundancies in place to protect your service, some DigiCert services may be unavailable during this time.

To make it easier to find the certificates ordered for a specific organization in your account, we updated the Organizations search on the Orders page.

We now display three new pieces of information about each organization. This information is helpful when you have organizations with similar or identical names:

See for yourself

In the left main menu, go to Certificates > Orders. On the Orders page, expand Show advanced search. In the Organizations dropdown, search for an organization. You will now see the following organization information: name, assumed name (if used), organization ID, and address.

To make it easier to identify the organization a certificate was ordered for in your account, we updated the Organization section on the Order details page.

We now display two new pieces of information about each organization:

See for yourself

In the left main menu, go to Certificates > Orders. On the Orders page, click the certificate's order number. On the Order details page, in the Organization section, you will now see the organization name, organization ID, and assumed name, if used.

To make it easier to associate a new domain with an organization in your account, we updated the Organization option on the New Domain page.

We now display three new pieces of information about each organization. This information is helpful when you have organizations with similar or identical names:

We also added the ability to type the name of the organization you are searching for.

See for yourself

In the left main menu, go to Certificates > Domains. On the Domains page, click New Domain. On the New Domain page, in the Organization dropdown, search for an organization. You will now see the following organization information: name, assumed name (if used), and organization ID. You can also type the organization name.

For more information about managing domains in CertCentral, see Manage domains.

To make it easier to specify the organizations a division can order certificates for in your account, we updated the Specific organizations option on the New Division and Edit Division pages.

We now display three new pieces of information about each organization. This information is helpful when you have organizations with similar or identical names:

We also added the ability to type the name of the organization you are searching for.

See for yourself

In the left main menu, go to Account > Divisions. On the Divisions page, click New Division. On the New Division page under Certificates can be ordered for, select Specific organizations. When you search for an organization in the dropdown, you will see the following organization information: name, assumed name (if used), organization ID, and address. You can also type the organization name.

For more information about divisions in CertCentral, see Division management.

To make it easier to order a client certificate for an organization in your account, we updated the Organization option in the client certificate request forms.

We now display three new pieces of information about each organization. This information is helpful when you have organizations with similar or identical names:

We also added the ability to type the name of the organization you are searching for.

See for yourself

The next time you request a client certificate, click Organization. In the Organization dropdown, you will see the following organization information: name, assumed name (if used), ID, and address. You can also type the organization name.

To make it easier to manage your subaccounts, we added two new endpoints to the CertCentral Services API:

To give you more control over your subaccounts, we added two new request parameters to the Create subaccount endpoint: child_name and max_allowed_multi_year_plan_length.

CertCentral Services API: Improved Create subaccount endpoint

{
    "account_type": "reseller",
    "user": {...},
    "organization": {...},
    "child_name": "Custom Name",
    "max_allowed_multi_year_plan_length": 4
}

After creating a subaccount, use the Subaccount info endpoint to view a subaccount's "display" name and allowed Multi-year Plan order length.

On February 16, 2021, between 18:00 – 22:00 MST (February 17, 2021, between 01:00 – 05:00 UTC), DigiCert will perform critical maintenance on the PKI Platform 8 Partner Lab.

On February 8, 2021, between 18:00 – 24:00 MST (February 9, 2021, between 01:00 – 07:00 UTC), DigiCert will perform critical maintenance on the PKI Platform 8 Partner Labs.

On February 6, 2021, between 22:00 – 24:00 MST (February 7, 2021, between 05:00 – 07:00 UTC), DigiCert will perform critical maintenance.

During maintenance, the services listed below will be down approximately 60 minutes. However, due to the scope of work happening, there may be additional service interruptions during the two-hour maintenance window.

You will be unable to sign in to these platforms and access these services and APIs:

DigiCert will be unable to issue certificates for these services and APIs:

These services will not be affected by the maintenance activities:

To make it easier to find your organizations on the Organization page, we now display three new pieces of information about each organization. This additional information is helpful when you have organizations with similar or identical names:

On the Organizations page, you will now see an Org # column with the organization's ID. You will also see the organization addresses displayed below the names. And, if you use the organization's assumed name, you will see it in parentheses next to the organization name.

For more information about organizations in CertCentral, see Manage organizations.

To make it easier to order a TLS/SSL certificate for an organization in your account, we updated the Add organization option in the OV and EV certificate request forms.

For accounts that issue certificates for 10 or more organizations, we now display three new pieces of organization information. This information is helpful when you have organizations with similar or identical names:

We also added the ability to type the name of the organization you are searching for.

See for yourself

The next time you request an OV or EV TLS/SSL certificate, click Add organization. In the Organization dropdown, you will see the following organization information: name, assumed name (if used), ID, and address. You can also type the organization name.

On the Orders page, we added two new search options:

The next time you search for an order, use the certificate's serial number or an additional email address to locate the certificate order.

To use the new search filters

To make it easier to find the DNS TXT email addresses that receive validation emails from DigiCert for email-based domain control validation (DCV), we added a new response parameter to the Domain emails endpoint: dns_txt_emails.

The dns_txt_emails parameter returns a list of email addresses found in the DNS TXT record for the domain. These are the email addresses we find in the DNS TXT record on the _validation-contactemail subdomain of the domain being validated.

{
  "name_scope": "example.com",
  "base_emails": [
    "admin@"example.com",
    "webmaster@example.com",
    "postmaster@example.com",
    "hostmaster@example.com",
    "administrator@example.com"
  ],
  "whois_emails": [
    "person@example.com"
  ],
  "dns_txt_emails": [
    "alice@example.com",
    "bob@example.com"
  ]
}

To learn more about the newly supported email to DNS TXT contact DCV method:

For information about validating the domains on DV certificate orders:

For information about validating the domains on OV/EV certificate orders:

We are happy to announce we added two new endpoints to the CertCentral Services API: Unit order details and Cancel unit order.

These endpoints allow you to get information about a unit order and to cancel a unit order.

Canceling unit orders:

If you manage a subaccount that uses units as its payment method, you can now use the Services API to do the following tasks:

To make it easier to find the available order validity periods for the digital certificate products in your account, we added new response parameters to the Product list, Product limits, and Product info endpoints.

These new response parameters allow you to view the default and customized order validity limits for each product in your account.

Product list endpoint

The allowed_order_validity_years parameter returns a list of the supported order validity periods for each product in your account.

Product limits endpoint

The allowed_order_lifetimes parameter returns a list of the customized order validity limits for users with different division and user role assignments in your account.

Product info endpoint

To make it easier to find information about the validity periods for subaccount orders, we added new response parameters to the Subaccount order info endpoint. These new response parameters allow you to see the order start date, the order end date, and whether the order is a Multi-year Plan.

{
...
    "date created": "2020-10-14T15:18:50+00:00",
    "date issued": "2020-10-14T15:18:52+00:00"
    "is multi year plan": "1",
    "order valid from": "2020-10-14"
    "order valid till": "2021-10-19"
    "validity years": 1
}

On January 9, 2021, between 22:00 – 24:00 MST (January 10, 2021, between 05:00 – 07:00 UTC), DigiCert will perform scheduled maintenance.

Although we have redundancies in place to protect your service, some DigiCert services may be unavailable during this time.

We are happy to announce that DigiCert now supports sending an email to a DNS TXT contact for email-based domain control validation (DCV). This means you can add email addresses to the DNS TXT record for your domain. DigiCert automatically searches the DNS TXT records and sends the DCV email to those addresses. An email recipient needs to follow the instructions in the email to demonstrate control over the domain.