Recertify a CA
Recertify a root CA or intermediate CA in DigiCert® Private CA that is approaching expiration so it can continue issuing under the same identity.
What changes
The new CA keeps the original Subject DN, including the Common Name, and reuses the original public and private key.
The new CA becomes active and takes over signing requests made to the original CA.
The original CA is disabled and can no longer issue. It remains visible for auditing and links to the new CA.
The new CA takes over CRL generation and OCSP responders where applicable.
For an online CA, the original issuance settings are reused. You cannot change CRL, OCSP, or related settings during recertification.
The new certificate starts at the current time. The end date defaults to the configured recertification period, subject to root validity rules, and you can change it within the supported limits.
To recertify a root CA or intermediate CA
In DigiCert ONE, in the Manager menu (top right), select CA.
In the account menu (top right), select the account that hosts the CA.
In the CA Services menu, select Manage CAs, then select Roots or Intermediates.
Find and select the CA you want to recertify.
In the Details section, select More actions (three dots) > Recertify CA.
Review the read-only inherited details, such as the Subject DN, CA template, key type, and Common Name.
Set the New validity period.
Select Create.
Verify the result
The new CA is Active and the original CA is Disabled. The Subject DN and public key are unchanged, and the new CA now generates CRLs and signs OCSP responses.
Recertified CAs and CA generations
When you recertify a CA, or replace its certificate, DigiCert Private CA keeps the original CA instead of overwriting it:
The latest CA in the lineage is Active. Earlier generations are Disabled, remain visible for auditing, and link to the new CA. The new CA links back to them.
Requests that use the original CA identifier, such as signing and view operations, are redirected to the latest active CA.
An earlier generation cannot be re-enabled for issuance.
If the active CA is revoked, all earlier generations in its lineage are revoked as well.