Replace a CA certificate
Replace a CA certificate when a root CA or ICA was recertified outside DigiCert® Private CA, for example by an external or legacy CA process. If you do not upload the new certificate, the private CA can keep using outdated CA information for CRL and OCSP operations, which can affect issuance and validation data.
What changes
The uploaded certificate replaces the current CA certificate. The CA identity and CA ID are preserved.
The replacement CA takes over the existing CRL, AIA, and OCSP data, and signs CRLs, OCSP responses, and child certificates.
Requests that use the CA ID resolve to the latest active version.
The original CA is retained with a new CA ID, a link to its replacement, a recertification timestamp, and a Disabled status.
For a root CA, the replacement certificate is allowed to have a later validity end date than the certificate it replaces.
Audit logging
In audit logs and the API, Replace is recorded as a recertification operation. A revoked CA cannot be replaced.
Before you begin
Confirm that the externally recertified certificate matches the CA you are replacing:
The Subject DN is identical to the CA's current Subject DN.
The public key is identical to the CA's current public key.
The certificate is signed by the expected issuer and has the serial number you expect.
To replace a CA certificate
In the left main menu, under Manage CAs, select Roots or Intermediates, and then select the CA.
On the CA details page, select More actions (three dots) > Replace CA, where available.
Upload the replacement certificate.
Click Save.
Verify the result
The replacement CA is Active, and the original CA is Disabled and linked to it. The uploaded certificate matches the intended CA.