About the CA lifecycle
A private root CA or intermediate CA moves through a small set of statuses. You control those changes with the lifecycle actions: disable and enable, recertify and replace, and revoke and reinstate.
CA statuses in DigiCert® Private CA:
Active: The CA can issue certificates and provide CRL and OCSP services.
Disabled: The CA's services are stopped. Issuance, CRL generation, and OCSP activity do not run. A disabled CA is also what remains of a CA that was recertified.
Revoked: The CA certificate is reported as no longer trusted through CRL and OCSP, and the CA cannot issue certificates.
Which action do I need?
If you need to... | Use | Reversible? |
|---|---|---|
Pause issuance and services temporarily, while the CA stays trusted. | Yes. Enable a CA to resume. | |
Renew an expiring CA inside DigiCert Private CA, keeping its identity. | No. The original CA stays disabled. | |
Bring in a CA certificate that was renewed outside DigiCert® ONE. | No. | |
Stop trusting an ICA because it is compromised, superseded, or retired. | Only if revoked with Certificate hold. See Reinstate a CA. |
These actions apply to Private CA. Disable and recertify apply to both root CAs and ICAs. Revoke applies to only intermediate CAs; root CA revocation is not supported in Private CA.
Audit logging
DigiCert Private CA records lifecycle actions in the audit logs, including Enable root, Disable root, Enable intermediate CA, and Disable intermediate CA, and the requests and approvals for revocation and reinstatement.