DigiCert ending support for vPro and KDC/SmartCardLogon EKUs in publicly trusted TLS/SSL certificates
On February 15, 2021, DigiCert will no longer issue public TLS/SSL certificates that include these EKUs
This means, as of February 15, 2021, we will no longer issue public TLS/SSL certificates that include either of these EKUs.
How does this affect me?
For most customers, this change will go unnoticed. It does not affect your TLS/SSL certificates or your TLS/SSL certificate process.
Note: By default, DigiCert does not issue public TLS/SSL certificates with the Intel vPro EKU or the KDC/SmartCardLogon EKU. To use these EKUs, we must first enable special certificate profiles for your account.
What if I use the Intel vPro EKU or the KDC/SmartCardLogon EKU in my public TLS/SSL certificates?
First, this change does not affect your existing public TLS/SSL certificates that include these EKUs. These certificates will continue to work as they always have until they expire.
However, on February 15, 2021, we will remove the Intel vPro EKU and KDC/SmartCardLogon EKU certificate profile options from all accounts. DigiCert will no longer issue new public TLS/SSL certificate orders the include these EKUs, including renewals, reissues, and duplicates.
Why is DigiCert doing this?
Industry standards specify that certificate authorities (CAs) should not include the Intel vPro and KDC/SmartCardLogon EKUS in public TLS/SSL certificates.
Therefore, to align with industry standards, we must stop including the Intel vPro and KDC/SmartCardLogon EKUS in our public TLS/SSL certificates.
More importantly, industry standards state that CAs should only include the serverAuth and, optionally, the clientAuth EKUs in public TLS certificates. See f. extKeyUsage (required) in section 22.214.171.124 Subscriber Certificate of the Baseline Requirements.
As of February 15, 2021, we will only include the serverAuth EKU and, as needed, the clientAuth EKU in our public TLS/SSL certificates.
Customize the lifetime of your DigiCert Multi-year Plan
We are happy to announce you can now configure a custom lifetime for your Multi-year Plan (MyP) when requesting a TLS certificate in CertCentral. On the TLS certificate request forms, use the new Custom order validity option to customize the length of your TLS certificate order.
Note: Maximum TLS certificate validity is 397 days per industry best practices. See End of 2-Year public SSL/TLS certificates.
Custom Multi-year Plan order lengths can be set in days or by expiration date. Maximum order length is 2190 days (6 years). Minimum order length is 7 days.
Note: Custom orders start on the day we issue the certificate for the order. Order pricing is prorated to match the certificate selected and your custom order length.
To customize your MyP coverage
Updated product settings for public TLS certificates
To provide more control over your certificate order process, we updated the product settings for public TLS certificates. Now, you can determine the allowed Multi-year Plan order lengths users can select from when ordering a public TLS certificate.
On the TLS certificate's product settings page, use the Allowed validity periods option to determine what MyP order lengths appear on a TLS certificate request form: 1 Year, 2 Years, 3 Years, 4 Years, 5 Years, and 6 Years. Note that changes made to product settings apply to requests placed through CertCentral and the Services API.
Note: Previously, the Allowed validity periods option was used to determine the maximum certificate lifetime a user could select when ordering a public TLS certificate. However, with the industry move to 1-year certificate this option is no longer needed for certificate lengths. See End of 2-Year public SSL/TLS certificates.
To configure the allowed MyP order lengths for a TLS certificate
The next time a user orders a Secure Site OV certificate, they will only see the validity period lengths you selected on the request form.
Note: Setting limits on Multi-year Plan order lengths removes the custom validity option from your TLS certificate request forms.
CertCentral Domains page: Improved domains.csv report
On the Domains page, we improved the CSV report to make it easier to track OV and EV domain validation expiration dates and to view the previously used domain control validation (DCV) method.
The next time you download the CSV file, you will see we three new columns in the report:
To download the domains.csv report
When you open the domains.csv, you should see the new columns and information in your report.
ICA certificate chain selection for public OV and EV flex certificates
We are happy to announce that public OV and EV certificates with flex capabilities now support Intermediate CA certificate chain selection.
You can add an option to your CertCentral account that enables you to control which DigiCert ICA certificate chain issues your public OV and EV "flex" certificates.
This option allows you to:
Configure ICA certificate chain selection
To enable ICA selection for your account, contact your account manager or our Support team. Then, in your CertCentral account, on the Product Settings page (in the left main menu, go to Settings > Product Settings), configure the default and allowed intermediates for each type of OV and EV flex certificate.
For more information and step-by-step instructions, see ICA certificate chain option for public OV and EV flex certificates.
DigiCert Services API support for ICA certificate chain selection
In the DigiCert Services API, we made the following updates to support ICA selection in your API integrations:
ca_cert_idparameter in the body of your order request
Example flex certificate request:
For more information about using ICA selection in your API integrations, see OV/EV certificate lifecycle – (Optional) ICA selection.
DigiCert will stop issuing 2-year public SSL/TLS certificates
On August 27, 2020 5:59 pm MDT (23:59 UTC), DigiCert will stop issuing 2-year public SSL/TLS certificates to prepare for the industry changes to the maximum allowed validity for public SSL/TLS certificates.
After the August 27 deadline, you can only purchase 1-year public SSL/TLS certificates.
What do I need to do?
To ensure you get needed 2-year public SSL/TLS certificates before the August 27 deadline:
To learn how this change will affect pending certificate orders, reissues, and duplicates, see End of 2-Year DV, OV, and EV public SSL/TLS certificates.
DigiCert Services API
For those using the DigiCert Services API, you'll need to update your API workflows to account for the new maximum certificate validity of 397 days for requests placed after the August 27 deadline. See Services API.
After August 27, 2020
After August 27, you can only purchase 1-year public SSL/TLS certificates. However, to maximize your SSL/TLS coverage, purchase your new certificates with a DigiCert® Multi-year Plan. See Multi-year Plans.
Why is DigiCert making this change?
On September 1, 2020, the industry says good-bye to 2-year certificates. Going forward Certificate Authorities (CA) can only issue public DV, OV, and EV SSL/TLS certificates with a maximum validity of 398 days (approximately 13 months).
DigiCert will implement a 397-day maximum validity for all public SSL/TLS certificates as a safeguard to account for time zone differences and to avoid issuing a public SSL/TLS certificate that exceeds the new 398-day maximum validity requirement.
Check out our blog to learn more about the transition to 1-year public SSL/TLS certificates: One-Year Public-Trust SSL Certificates: DigiCert’s Here to Help.
DigiCert® Multi-year Plans available for all DigiCert public SSL/TLS certificates
We are happy to announce that Multi-year Plans are now available for all public SSL/TLS certificates in CertCentral. These plans allow you to pay a single discounted price for up to six years of SSL/TLS certificate coverage.
Note: Enterprise License Agreement (ELA) contracts support only 1 and 2-year Multi-year Plans. Flat Fee contracts do not support Multi-year Plans. If you have a Flat Fee contract, please contact your account manager to find a solution that works with your contract.
With Multi-year Plans, you pick the SSL/TLS certificate, the duration of coverage you want (up to six years), and the certificate validity. Until the plan expires, you reissue your certificate at no cost each time it reaches the end of its validity period. For more information, see Multi-year Plans.
DigiCert Services API changes to support Multi-year Plans
In our Services API, we updated our public SSL/TLS certificate endpoints to support ordering a certificate with a Multi-year Plan.
To each endpoint for ordering a public SSL/TLS certificate, we added new optional* request parameters. Additionally, we've updated these endpoints such that the validity period of your order no longer must match the validity period of your certificate.
*Note: Requests must include a value for either the order_validity object or for one of the top-level order validity parameters: validity_years, validity_days, or custom_expiration_date. The values provided in the order_validity object override the top-level validity parameters.
These changes should not affect your current integrations. However, to maximize your SSL/TLS coverage, you may want to start purchasing your public SSL/TLS certificates with a Multi-year Plan. For API integrations, see Order Multi-year Plan.
Example certificate request with new parameters
CertCentral: Automatic DCV checks – DCV polling
We are happy to announce we've improved the domain control validation (DCV) process and added automatic checks for DNS TXT, DNS CNAME, and HTTP practical demonstration (FileAuth) DCV methods.
This means, once you've placed the fileauth.txt file on your domain or added the random value to your DNS TXT or DNS CNAME records, you don't need to worry about signing in to CertCentral to run the check yourself. We will run the DCV check automatically. Although, you can still run a manual check, when needed.
DCV polling cadence
After submitting your public SSL/TLS certificate order, submitting a domain for prevalidation, or changing the DCV method for a domain, DCV polling begins immediately and runs for one week.
*After Interval 5, we stop checking. If you have not placed the fileauth.txt file on your domain or added the random value to your DNS TXT or DNS CNAME records by the end of the first week, you will need to run the check yourself.
For more information about the supported DCV methods: