To make it easier to plan your certificate related tasks, we scheduled our 2021 maintenance windows in advance. See DigiCert 2021 scheduled maintenance—this page is kept up to date with all maintenance schedule information.
With customers all over the world, we understand there is not a best time for everyone. However, after reviewing the data on customer usage, we selected times that would impact the fewest amount of our customers.
About our maintenance schedule
If you need more information regarding these maintenance windows, contact your account manager or DigiCert support team. To get live updates, subscribe to the DigiCert Status page.
CertCentral Services API: Improved Create subaccount endpoint
To give you more control over your subaccounts, we added two new request parameters to the Create subaccount endpoint: child_name
and max_allowed_multi_year_plan_length
.
child_name
– Use this parameter to set a custom display name for the subaccount.max_allowed_multi_year_plan_length
– Use this parameter to customize the maximum length of Multi-year Plan orders for the subaccount.Example JSON request:
After creating a subaccount, use the Subaccount info endpoint to view a subaccount's "display" name and allowed Multi-year Plan order length.
Upcoming scheduled maintenance
On January 9, 2021 between 22:00 – 24:00 MST (January 10, 2021 between 05:00 – 07:00 UTC), DigiCert will perform scheduled maintenance.
Although we have redundancies in place to protect your service, some DigiCert services may be unavailable during this time.
What can you do?
Please plan accordingly.
Services will be restored as soon as maintenance is completed.
Customize the lifetime of your DigiCert Multi-year Plan
We are happy to announce you can now configure a custom lifetime for your Multi-year Plan (MyP) when requesting a TLS certificate in CertCentral. On the TLS certificate request forms, use the new Custom order validity option to customize the length of your TLS certificate order.
Note: Maximum TLS certificate validity is 397 days per industry best practices. See End of 2-Year public SSL/TLS certificates.
Custom Multi-year Plan order lengths can be set in days or by expiration date. Maximum order length is 2190 days (6 years). Minimum order length is 7 days.
Note: Custom orders start on the day we issue the certificate for the order. Order pricing is prorated to match the certificate selected and your custom order length.
To customize your MyP coverage
Updated product settings for public TLS certificates
To provide more control over your certificate order process, we updated the product settings for public TLS certificates. Now, you can determine the allowed Multi-year Plan order lengths users can select from when ordering a public TLS certificate.
On the TLS certificate's product settings page, use the Allowed validity periods option to determine what MyP order lengths appear on a TLS certificate request form: 1 Year, 2 Years, 3 Years, 4 Years, 5 Years, and 6 Years. Note that changes made to product settings apply to requests placed through CertCentral and the Services API.
Note: Previously, the Allowed validity periods option was used to determine the maximum certificate lifetime a user could select when ordering a public TLS certificate. However, with the industry move to 1-year certificate this option is no longer needed for certificate lengths. See End of 2-Year public SSL/TLS certificates.
To configure the allowed MyP order lengths for a TLS certificate
The next time a user orders a Secure Site OV certificate, they will only see the validity period lengths you selected on the request form.
Note: Setting limits on Multi-year Plan order lengths removes the custom validity option from your TLS certificate request forms.
CertCentral Domains page: Improved domains.csv report
On the Domains page, we improved the CSV report to make it easier to track OV and EV domain validation expiration dates and to view the previously used domain control validation (DCV) method.
The next time you download the CSV file, you will see we three new columns in the report:
To download the domains.csv report
When you open the domains.csv, you should see the new columns and information in your report.
CertCentral Guest access feature
We are happy to announce Guest access is now available for CertCentral Enterprise and CertCentral Partner. This feature allows users to manage a certificate order without you having to add them to your CertCentral account.
Guest access provides your account with a unique URL that can be shared with non-account users so they can access a certificate order. This is a quick, easy, and secure way to share access to a certificate order with someone who you doesn't need account access, only the ability to download, reissue, renew, or revoke the certificate.
Note: Guest access allows you to manage a single order at a time and does not provide the user with access to any other CertCentral information or features.
To use Guest access, first enable it for your account; in the left menu, go to Account > Guest Access. For more information about Guest access and how to configure it for your account, see Guest access.
To access an order via Guest access:
Now, you can view the certificate order and download, reissue, renew, or revoke the certificate.
Scheduled maintenance
On December 6, 2020 between 08:00 – 10:00 UTC, DigiCert will perform scheduled maintenance.
How does this affect me?
During maintenance, access to these services and APIs may be affected:
Additionally, certificate issuance for these services and APIs may be affected:
What can I do?
Plan accordingly.
Services will be restored as soon as the maintenance is completed.
CertCentral Orders page: Improved load times
In CertCentral, we updated the Orders page to improve load times for those managing high volumes of certificate orders. The next time you visit the Orders page, it will open much quicker (in the left main menu go to Certificates > Orders).
To improve load times, we changed the way we filter your certificate orders upon initial page view. Previously, we filtered the page to show only Active certificate orders. However, this was problematic for those with high volumes of certificate orders. The more orders you have in your account, the longer the Orders page took to open.
Now, when you visit the page, we return all your certificates, unfiltered, in descending order with the most recently created certificate orders appearing first in the list. To see only your active certificates, in the Status dropdown, select Active and click Go.
CertCentral Services API: Purchase units for subaccounts and view unit orders
In the CertCentral Services API, we've added new endpoints for purchasing units and viewing unit orders. Now, if you manage subaccounts that use units as the payment method for certificate requests, you can use the Services API to buy more units for a subaccount and to get information about your unit order history.
For more information, see the reference documentation for the new endpoints:
Scheduled maintenance
On November 8, 2020 between 08:00 – 10:00 UTC, DigiCert will perform scheduled maintenance.
How does this affect me?
During maintenance, access to these services and APIs may be affected:
Additionally, certificate issuance for these services and APIs may be affected:
What can I do?
Plan accordingly.
Services will be restored as soon as the maintenance is completed.
Schedule Maintenance
On Sunday October 4 between 07:00 – 09:00 UTC, DigiCert will perform scheduled maintenance.
How does this affect me?
Although we have redundancies in place to protect your services, some DigiCert services may be unavailable during this time.
During maintenance access to these services and APIs may be affected:
Additionally, certificate issuance for these services and APIs may be affected:
What can I do?
Please plan accordingly. Schedule high-priority orders, renewals, reissues, and duplicate issues outside of the maintenance window. If you use the APIs for immediate certificate issuance and automated tasks, expect interruptions during this time.
Services will be restored as soon as the maintenance is completed.
Upcoming scheduled maintenance
On Sunday September 13, 2020 from 07:00 to 09:00 UTC, DigiCert will perform scheduled maintenance.
How does this affect me?
During maintenance, we will assign new dedicated IP addresses to our CertCentral mail server, some of our services, and some of our APIs.
Affected services:
For more details and easy reference, see our IP address changes knowledgebase article.
Although we have redundancies in place to protect your service, some DigiCert services may be unavailable during this time.
DigiCert services will be restored as soon as maintenance is completed.
What can I do?
DigiCert® Multi-year Plans available for all DigiCert public SSL/TLS certificates
We are happy to announce that Multi-year Plans are now available for all public SSL/TLS certificates in CertCentral. These plans allow you to pay a single discounted price for up to six years of SSL/TLS certificate coverage.
Note: Enterprise License Agreement (ELA) contracts support only 1 and 2-year Multi-year Plans. Flat Fee contracts do not support Multi-year Plans. If you have a Flat Fee contract, please contact your account manager to find a solution that works with your contract.
With Multi-year Plans, you pick the SSL/TLS certificate, the duration of coverage you want (up to six years), and the certificate validity. Until the plan expires, you reissue your certificate at no cost each time it reaches the end of its validity period. For more information, see Multi-year Plans.
DigiCert Services API changes to support Multi-year Plans
In our Services API, we updated our public SSL/TLS certificate endpoints to support ordering a certificate with a Multi-year Plan.
To each endpoint for ordering a public SSL/TLS certificate, we added new optional* request parameters. Additionally, we've updated these endpoints such that the validity period of your order no longer must match the validity period of your certificate.
*Note: Requests must include a value for either the order_validity object or for one of the top-level order validity parameters: validity_years, validity_days, or custom_expiration_date. The values provided in the order_validity object override the top-level validity parameters.
These changes should not affect your current integrations. However, to maximize your SSL/TLS coverage, you may want to start purchasing your public SSL/TLS certificates with a Multi-year Plan. For API integrations, see Order Multi-year Plan.
Example certificate request with new parameters
CertCentral: DigiCert changes payment remittance bank account
To improve order processing and our customer service, we changed our payment remittance bank account.
What do I need to do?
Update your accounts payable processes to make sure all future payments are credited to our Bank of America account. For more information, see our Payment Information knowledgebase article.
Note: For customers with Symantec, GeoTrust, Thawte, and RapidSSL certificates, this is the same bank account you previously used.
Upcoming Emergency Maintenance
On Sunday June 28, 2020 from 07:00 to 08:00 UTC DigiCert will perform emergency maintenance.
How does this affect me?
During this time, DigiCert will be unable to issue certificates for DigiCert platforms and their corresponding APIs, legacy Symantec consoles and their corresponding APIs, for immediate certificate issuance, and for those using the APIs for automated tasks.
Emergency maintenance affects:
Services will be restored as soon as maintenance is completed.
What can you do?
Please plan accordingly. Schedule high-priority orders, renewals, reissues, and duplicate issues outside of the maintenance window.
If you use the API for automated tasks, expect interruptions during this time.
Legacy account upgrades to CertCentral: Mark migrated certificate orders as renewed
When you migrate a certificate order from your legacy console and then renew it in CertCentral, the original order may not get updated automatically to reflect the renewal. To make it easier to manage these migrated certificates, we added a new option—Mark renewed.
The Mark renewed option allows you to change the certificate order's status to Renewed. In addition, the original migrated certificate no longer appears in expiring or expired certificate lists, in the expiring or expired certificate banners, or on the Expired Certificates page in CertCentral.
Mark a migrated order as renewed
In CertCentral, in the left main menu, go to Certificates > Orders. On the Orders page, in the certificate order's Expires column, click Mark renewed.
Renewed filter
To make it easier to see the migrated certificate orders that have been marked renewed, we added a new filter—Renewed. On the Orders page, in the Status filter dropdown, select Renewed and click Go.
To learn more, see Mark a migrated certificate order as renewed.
Legacy API upgrades to CertCentral Services API: Update order status endpoint improvements
When you migrate an order from your legacy console and then renew it in CertCentral, the original order may not get updated automatically to reflect the renewal.
To prevent these "renewed" orders from appearing alongside orders that still need to be renewed, we added a new value—renewed—to the status parameter on the Update order status endpoint.
Now, when you know a migrated certificate order has been renewed, you can manually change the status of the original order to renewed.
Example request with new status parameter
To learn more, see Update order status.
我们很高兴地宣布,目前在 CertCentral 中新增了四种产品:
这些 SSL/TLS 证书更加灵活,因此能够更轻松地获取符合您需要的证书,并且会替换旧的 Basic 和 Secure Site 产品。要对您的 CertCentral 帐户启用其中任何一种新证书,请联系您的客户经理或我们的支持团队。
灵活的 Basic OV 和 EV 证书
这些证书提供 DigiCert SSL/TLS 证书的加密和身份验证,让您可以构建具有任意域和通配符域*组合的 OV 或 EV 证书,以适合您的需要。
*注意:您只能在 OV SSL/TLS 证书中包括通配符域。EV SSL/TLS 证书不支持使用通配符域。
灵活的 Secure Site OV 和 EV 证书
这是证书包括 Basic OV 和 EV 证书的所有相同功能。而且还具有所有 Secure Site 证书的权益。
我们很高兴宣布推出新的 DigiCert 文档门户。该新网站采用现代风格的外观和风格,包含优化的、基于任务的帮助文档、产品新闻、变更日志以及 API 开发人员文档。
我们还很高兴地宣布,新的 DigiCert 开发人员门户已经完成测试。该开发人员网站采用现代风格的外观和风格,包含关于可用端点、用例和工作流的信息。
提示和技巧
即将推出
入门指南将包含有用信息以帮助您熟悉您的帐户中的功能。
我们改进了 DigiCert 帐户登录页面的外观和风格 (www.digicert.com/account/),与我们的证书管理平台 CertCentral 的设计保持一致。
RapidSSL 和 GeoTrust DV 证书在 CertCentral 中可用:
文档
我们改进了域管理 - 获取域控制电子邮件 API 端点的功能。您现在可以使用域名检索任何域的域控制验证 (DCV) 电子邮件地址(基于 WHOIS 的电子邮件和构造的电子邮件)。
以前,您必须具有域 ID 才能检索 DCV 电子邮件地址。但是,要为域获得 ID,必须提交域进行预验证。
现在,您可以使用域名或域 ID,通过域管理 - 获取域控制电子邮件端点检索域的 DCV 电子邮件地址(基于 WHOIS 的电子邮件和构造的电子邮件)。请参阅获取域电子邮件端点。
我们新增了订单管理 - 吊销证书 API 端点,您可以使用订单编号吊销与单个订单关联的所有证书,因此更容易使用 API 吊销已颁发的证书。这确保可以一次性吊销与订单关联的所有副本或补发证书。
注意:在提交证书吊销请求后,管理员需批准请求后,DigiCert 才能吊销与该订单关联的证书。请参阅更新请求状态 API 端点。
有关新端点和其他公开可用端点的更多信息,请参阅我们的 CertCentral API 文件中的吊销证书 API 端点。
Secure Site TLS/SSL 证书在 CertCentral 中可用:
要对您的 CertCentral 帐户启用 Secure Site 证书,请联系您的销售代表。
每张 Secure Site 证书所包含的优势:
欲了解有关我们的 Secure Site 证书的更多信息,请参阅 DigiCert Secure Site 概述。
其他资源:
更新至完整的 SHA256 EV 层次结构证书配置文件
2018 年 9 月 27 日,我们从完整 SHA256 EV 层次机构中颁发的 EV TLS 证书中删除了 Symantec 策略 OID[DigiCert Global G2 Root => DigiCert Global G2 Intermediate => EV TLS/SSL 证书]。
问题:macOS 上出现 Chrome 错误
2018 年 7 月,我们发现 macOS 上存在 Chrome 错误,无法显示具有两个以上策略 OID 的 EV TLS 证书的 EV 指示符 - https://bugs.chromium.org/p/chromium/issues/detail?id=867944。
解决方案
我们从完整的 SHA256 EV 层次结构证书配置文件中删除了 Symantec 策略 OID。通过此更改,macOS 上的 Chrome 再次显示从完整的 SHA256 EV 层次结构颁发的 EV TLS 证书 EV 指示符。
受影响的 EV TLS 证书
在 2018 年 1 月 31 日之后至 2018 年 9 月 27 日之前颁发的(来自完整的 SHA256 EV 层次结构)的 EV TLS 证书的证书扩展名 - 证书策略中包含这三个策略 OID:
我需要做些什么?
我们修复了订单详细信息页面错误,以前在该页面上显示与证书订单无关的信息。
现在,当您访问 TLS/SSL、代码签名、EV 代码签名、客户端和文档签名证书订单详细信息页面时,仅显示与该订单相关的信息。
我们在 EV TLS/SSL 证书请求流程中新增了添加联系人功能,因此您可以在申请过程中指定现有 CertCentral 用户(管理员、经理、财务经理或用户)为该组织的已验证的 EV 联系人。
以前,您必须在申请证书前为组织指定已验证的 EV 联系人(证书 > 组织)。
启用允许使用非 CertCentral 帐户用户作为已验证的联系人
在分区首选项页面(设置 > 首选项)的高级设置部分的已验证的联系人下,您可以允许使用非 CertCentral 帐户用户作为已验证的联系人(选中允许使用非 DigiCert 用户作为已验证的联系人)。
启用非 CertCentral 用户功能后,在 EV 证书请求过程中添加已认证的联系人时,您将看到两个选项:现有联系人和新建联系人。现有联系人选项用于将 CertCentral 用户指定为已验证的 EV 联系人。新建联系人选项用于输入非 CertCentral 帐户用户的信息。
我们添加了跳过审批步骤功能,该功能可用于删除 SSL、代码签名和文档签名证书订购流程中的审批步骤。
注意:仅证书吊销请求、来宾 URL 证书请求以及财务管理员、标准用户和受限用户证书请求需要提交管理员审批。
您可以在分区首选项页面上启用该功能(设置 > 首选项)。在证书请求部分(展开高级设置)的审批步骤下,选择跳过审批步骤:移除证书订购流程中的审批步骤,返回单击保存设置。
注意:这些订单无需审批,因此不会在请求页(证书 > 请求)列出。而是仅显示在订单页(证书 > 订单)。
我们新增了获取订单状态更改端点,使用 DigiCert 服务 API 的用户可检查所有证书订单在指定时间范围内(最多一周)的状态。
有关此新端点的更多信息,请参阅订单管理 - 获取订单状态更改(位于 DigiCert 服务 API 文档中)。
我们修复了 CT 日志消息错误,以前我们指示私有或其他非公共 SSL/TLS 证书已记录到 CT 日志中,而实际上没有。
注意:DigiCert 不会将私有 SSL/TLS 证书和非 SSL/TLS 证书记录到 CT 日志。业内仅对公共 SSL/TLS 证书使用 CT 日志。
现在,当您查看您的私有 SSL/TLS 证书或非 SSL/TLS 证书(例如,客户端证书)的证书详细信息时,您不会看到任何 CT 日志记录信息。
我们修复了订单页面(证书 > 订单)上的搜索功能错误,以前您无法使用公用名搜索客户端证书。
现在,当您使用公用名搜索特定客户端证书时,如果存在匹配,将返回您的结果。
我们修复了证书服务协议 UI 错误,以前有些字符和符号使用错误的编码显示。
现在当您浏览证书服务协议时,所有字符和符号都将具有正确的编码。
我们修复了受限用户角色错误。当管理员为证书订单指定受限用户时,受限用户不会获得续订、补发或吊销证书所需的权限。
现在,当为证书订单指定受限用户后,他们可以续订、补发或吊销证书。
我们修复了请求页面上的搜索功能错误和分区筛选错误(证书 > 请求)。
现在,当您使用请求编号、订单编号、公用名等搜索特定请求时,如果存在匹配,将返回您的结果。此外,分区筛选将返回所选分区的请求。
我们修复了 CertCentral 仪表板上的待处理的证书请求小工具错误。
现在,待处理的证书请求小工具上的待处理的证书请求的数量(新请求和吊销请求)将和请求页面(证书 > 请求)上的待处理的证书请求数量一致。
新增了更改 CSR 功能。该功能可用于更改待处理的证书订单上的 CSR(在批准证书之后且颁发证书之前)。
在订单页面(证书 > 订单),找到待处理的证书订单并单击其订单编号链接。在订单详细信息页面的正在验证部分的您需要执行的操作下,单击更改 CSR 链接可更改 CSR。
注意:对于等待审批的证书请求,您可以在证书审批之前更改 CSR。在请求页面(证书 > 订单),找到待处理的证书请求并单击其订单编号链接。在右侧的请求详细信息窗格,单击编辑链接可更改 CSR。
CertCentral API:新更改 CSR 端点
我们还增加了更改 CSR 端点,使用 DigiCert 服务 API 的用户可在待处理的 SSL/TLS 证书上更改 CSR。有关此新端点的更多信息,请参阅订单管理 - 添加 CSR(位于 DigiCert 服务 API 文档中)。
修复了单一登录错误。当仅 SSO 用户请求重置 CertCentral 密码时,他们将不再收到密码重置电子邮件。
现在,他们将收到一封电子邮件,其中指示他们使用 SSO 登录并要求他们在需要使用不同类型的帐户访问权限时联系其 CertCentral 客户经理。
在待处理订单详细信息页面新增了功能(单击证书 > 订单,然后单击待处理的订单编号链接)。该功能可用于对待处理订单上的域完成域控制验证 (DCV)。
当您看到订单正在等待完成域验证后方可颁发证书时,可单击待处理的域链接以打开证明对域的控制权弹窗。在该窗口中,您可以选择或更改 DCV 方法并对该域完成验证(发送或重新发送电子邮件,检查 DNS TXT 记录等)。请参阅域验证(待处理订单):域控制验证 (DCV) 方法。
改进了订单编号页面(依次单击证书 > 订单和订单编号链接)和订单编号详细信息窗格(依次单击证书 > 订单和快速查看链接)。
查看订单的验证状态时,您现在可以看到订单上的每个 SAN 的验证状态:待处理或已完成。
改进了 SSL 证书请求(申请证书 > SSL 证书)和 SSL 证书续订页面。我们简化了申请和续订页面的外观和风格,将特定的信息放在可展开部分。这让最终用户可以关注于订单和续订流程最重要的部分。
我们将以下证书和订单选项分组放在下列标题部分。
改进了订单编号页面(依次单击证书 > 订单和订单编号链接)和订单编号详细信息窗格(依次单击证书 > 订单和快速查看链接)。
您现在可以看到订单的验证状态:待处理或已完成。您还可以查看订单是否在等待完成域或组织验证后才颁发证书。
这仅用于提供信息,无需执行任何操作。
从 2018 年 2 月 1 日开始,DigiCert 将所有新颁发的公共 SSL/TLS 证书发布到公共 CT 日志中。这不会影响在 2018 年 2 月 1 日之前颁发的任何 OV 证书。请注意,从 2015 年起,已经要求对 EV 证书进行 CT 日志记录。请参阅从 2 月 1 日起将 DigiCert 证书记录到公共日志。
在 CertCentral 中新增了"在订购证书时从 CT 日志中排除"功能。当您启用此功能(设置 > 首选项)时,您允许帐户用户基于每证书订单将公共 SSL/TLS 证书保留在公共 CT 日志之外。
订购 SSL 证书时,用户可选择不将 SSL/TLS 证书记录到公共 CT 日志中。当用户订购新证书、补发证书和续订证书时,该功能可用。请参阅 CertCentral 公共 SSL/TLS 证书 CT 日志指南。
在 SSL 证书请求 API 端点中新增了 CT 日志排除可选字段 (disable_ct)。此外,新增了 CT 日志颁发的证书排除端点 (ct-status)。请参阅 CertCentral API 公共 SSL/TLS 证书透明度排除指南。
增强了概览页面(单击仪表板)。增加了从仪表板申请证书的功能;注意页面顶部的新申请证书按钮。
增强了即将到期的证书页面(单击证书 > 即将到期的证书)。增加了快速查看链接,无需离开页面也可查看每个即将到期的证书的详细信息。
增强了订单页面(单击证书 > 订单);改进了页面性能。
增强了订单详细信息页面(单击证书 > 订单页面上的订单编号时显示);改进了页面性能。
增强了请求页面上的订单详细信息窗格(单击订单编号时显示);改进了页面性能。
增强了用户列表查询;改进了用户搜索以及页面性能(例如,订单页面)。
增强了申请证书页面;改进了组织和域搜索以及页面性能。
在"帮助" (?) 菜单下拉列表中包括了新功能;增加了新变更记录页面的链接。
修复了客户端证书的提交订单端点
在 CertCentral API 中,更新了“提交订单”端点,允许您自动或手动续订证书。该更改影响客户端证书订单和客户端证书续订订单。有关更多信息,请参阅我们的 DigiCert 服务 API 文档。
客户端证书订单:
在客户端证书订单上,"is_renewed" 值已适当包括在返回的响应主体中。
"is_renewed": false,
"is_renewed": true,
CertCentral API - 客户端证书续订
这些更改仅适用于手动触发的客户端证书续订,不适用于通过自动续订功能触发的客户端证书续订。
POST
使用 CertCentral API 提交客户端证书续订请求时,在端点中添加以下参数:POST /order/certificate/{order_id}body:"renewal_of_order_id": "1234567"
GET
从现在起,当您查看新订单(即将到期的原始证书续订订单)时,在返回的响应主体中包含这两个续订字段:"is_renewed": true,
"renewed_order_id": 1234567,
"renewed_order_id" 是您续订的原始订单的订单编号。
增强了客户端证书;增加了对多组织单位 (OU) 的支持。
增强了客户端证书;增加了对多组织单位 (OU) 的支持。
修复了帐单联系人错误。更改分区中的帐单联系人不会更改其他分区的帐单联系人(例如,顶层分区)。
增强了帐户余额和采购订单流程。请参阅 CertCentral 帐户余额和采购订单流程更改。
在"帮助" (?) 下拉列表中包括了新功能;增加了 DigiCert CertCentral 入门指南的链接。