Change log | docs.digicert.com

九月 27, 2022

CertCentral Services API: Keep the "www" subdomain label when adding a domain to your account

To give you more control over your domain prevalidation workflows, we added a new optional request parameter to the Add domain API endpoint: keep_www. Use this parameter to keep the www. subdomain label when you add a domain using a domain control validation (DCV) method of email, dns-txt-token, or dns-cname-token.

By default, if you are not using file-based DCV, the Add domain endpoint always removes the www. subdomain label from the name value. For example, if you send www.example.com, DigiCert adds example.com to your account and submits it for validation.

To keep the www and limit the scope of the approval to the www subdomain, set the value of the keep_www request parameter to true:

Learn more

八月 22, 2022

DCV expiration dates list domains domain info DCV Services API domain prevalidation

CertCentral Services API: New response parameters for Domain info and List domains endpoints

To make it easier for API clients to get the exact date and time domain validation reuse periods expire, we added new response parameters to the Domain info and List domains API endpoints:

dcv_approval_datetime: Completion date and time (UTC) of the most recent DCV check for the domain.
dcv_expiration_datetime: Expiration date and time (UTC) of the most recent DCV check for the domain.

Note: For domain validation expiration dates, use the new dcv_expiration_datetime response parameter instead of relying on the dcv_expiration.ov and dcv_expiration.ev fields. Since October 1, 2021, the domain validation reuse period is the same for both OV and EV TLS/SSL certificate issuance. The new dcv_expiration_datetime response parameter returns the expiration date for both OV and EV domain validation.

Learn more:

三月 10, 2022

Services API DCV CertCentral New CNAME DV Certificates domain control validation

CertCentral: DNS CNAME DCV method now available for DV certificate orders

In CertCentral and the CertCentral Services API, you can now use the DNS CNAME domain control validation (DCV) method to validate the domains on your DV certificate order.

Note: Before, you could only use the DNS CNAME DCV method to validate the domains on OV and EV certificate orders and when prevalidating domains.

To use the DNS CNAME DCV method on your DV certificate order:

In CertCentral:
- When ordering a DV TLS certificate, you can select DNS CNAME as the DCV method.
- On the DV TLS certificate's order details page, you can change the DCV method to DNS CNAME Record.
In the Services API:
- When requesting a DV TLS certificate, set the value of the dcv_method request parameter to dns‑cname‑token.

Note: The AuthKey process for generating request tokens for immediate DV certificate issuance does not support the DNS CNAME DCV method. However, you can use the File Auth (http‑token) and DNS TXT (dns‑txt‑token) DCV methods. To learn more, visit DV certificate immediate issuance.

To learn more about using the DNS CNAME DCV method:

For CertCentral:
For the Services API:
- Order DV GeoTrust SSL
- DV certificate lifecycle

三月 8, 2022

domains Services API DCV pre-validation

CertCentral Services API: Improved List domains endpoint response

To make it easier to find information about the domain control validation (DCV) status for domains in your CertCentral account, we added these response parameters to domain objects in the List domains API response:

dcv_approval_datetime: Completion date and time of the most recent DCV check for the domain.
last_submitted_datetime: Date and time the domain was last submitted for validation.

For more information, see the reference documentation for the List domains endpoint.

十一月 16, 2021

File api OV SSL certificates DCV CertCentral domain validation DV SSL certificates http token HTTP Practical Demonstration EV SSL certificates tls certificates FileAuth Services API SSL certificates domain control validation wildcard domains http auth SC45 domain prevalidation file-based DCV

Industry changes to file-based DCV (HTTP Practical Demonstration, file auth, file, HTTP token, and HTTP auth)

To comply with new industry standards for the file-based domain control validation (DCV) method, you can only use the file-based DCV to demonstrate control over fully qualified domain names (FQDNs), exactly as named.

To learn more about the industry change, see Domain validation policy changes in 2021.

How does this affect me?

As of November 16, 2021, you must use one of the other supported DCV methods, such as Email, DNS TXT, and CNAME, to:

Validate wildcard domains (*.example.com)
To include subdomains in the domain validation when validating the higher-level domain. For example, if you want to cover www.example.com, when you validate the higher-level domain, example.com.
Prevalidate entire domains and subdomains.

To learn more about the supported DCV method for DV, OV, and EV certificate requests:

CertCentral: Pending certificate requests and domain prevalidation using file-based DCV

Pending certificate request

If you have a pending certificate request with incomplete file-based DCV checks, you may need to switch DCV methods* or use the file-based DCV method to demonstrate control over every fully qualified domain name, exactly as named, on the request.

*Note: For certificate requests with incomplete file-based DCV checks for wildcard domains, you must use a different DCV method.

To learn more about the supported DCV methods for DV, OV, and EV certificate requests:

Domain prevalidation

If you plan to use the file-based DCV method to prevalidate an entire domain or entire subdomain, you must use a different DCV method.

To learn more about the supported DCV methods for domain prevalidation, see Supported domain control validation (DCV) methods for domain prevalidation.

CertCentral Services API

If you use the CertCentral Services API to order certificates or submit domains for prevalidation using file-based DCV (http-token), this change may affect your API integrations. To learn more, visit File-based domain control validation (http-token).

九月 8, 2021

DCV expiration dates OV validation list domains domain info DCV CertCentral domain validation API filters list subaccount domains expiring domains count Services API

CertCentral Services API: Domain management enhancements

To make it easier to maintain active validation for domains in your account, we added new filters, response fields, and a new endpoint to our domain management APIs. With these updates, you can:

Find domains with OV and EV validation reuse periods that are expired or expiring soon.
Find domains affected by the September 27, 2021 policy change to shorten OV domain validation reuse periods.*

Enhanced APIs: List domains and List subaccount domains

We made the following enhancements to the List domains and List subaccount domains endpoints:

Added validation filter values
On September 27, 2021*, existing OV domain validation reuse periods will shorten to 397 days from the date validation was completed. For some domains, the reduced validation period will have already expired, or will expire before the end of 2021.

To help you find these domains so you can resubmit them for validation, we added a new value for the validation filter: shortened_by_industry_changes. We also added filter values to help you find domains with OV or EV domain validation periods that expire in different timeframes. The new validation filter values include:
- shortened_by_industry_changes
- ov_expired_in_last_7_days
- ov_expiring_within_7_days
- ov_expiring_within_30_days
- ov_expiring_from_31_to_60_days
- ov_expiring_from_61_to_90_days
- ev_expired_in_last_7_days
- ev_expiring_within_7_days
- ev_expiring_within_30_days
- ev_expiring_from_31_to_60_days
- ev_expiring_from_61_to_90_days
Added fields to the dcv_expiration object
You can now submit a request that returns the following fields in the dcv_expiration object: ov_shortened, ov_status, ev_status, and dcv_approval_date. These fields only return if your request includes the newly added query string filters[include_validation_reuse_status]=true.
Added dcv_method filter
We added the option to filter domains by domain control validation (DCV) method. To use this filter, append the query string filters[dcv_method]={{value}} to the request URL. Possible values are email, dns-cname-token, dns-txt-token, http-token, and http-token-static.

Enhanced API: Domain info
You can now submit a request to the Domain info endpoint that returns the following fields in the dcv_expiration object: ov_shortened, ov_status, ev_status, and dcv_approval_date. These fields only return if your request includes the newly added query string include_validation_reuse_status=true.

New API: Expiring domains count

We added a new endpoint that returns the number of domains in your account with expired or expiring OV or EV domain validations. For more information, see Expiring domains count.

*On September 27, 2021, the expiration date for existing OV domain validations will shorten to 397 days from the date validation was completed. Learn more about this policy change: Domain validation changes in 2021.

七月 22, 2020

documentation api TLS 1.0 TLS 1.1 browsers DCV certcentral compliance Services API DV certificate issuance error messages CertCentral Partners Multi-year plan MyP

現在推出多年套餐

我們很榮幸宣佈現在 CertCentral 和 CertCentral Partners 可使用多年套餐。

DigiCert® 多年套餐允許您支付一次費用即可得到最長六年的 SSL/TLS 憑證涵蓋時間。使用多年套餐後，您可以選擇 SSL/TLS 憑證、您想要涵蓋的時間長度 (最長六年) 和憑證有效性。訂單到期前，每次重新發行憑證時都無需其他費用，直到有效期間結束為止。

2020 年 9 月 1 日，SSL/TLS 憑證有效期將從 825 天變成 397 天。多年套餐的啟用的憑證即將到期時，重新發行憑證以保持您的 SSL/TLS 涵蓋時間。

如需更多資訊，請參閱多年套餐。
關於 API 整合，請參閱訂購多年套餐。

瀏覽器結束支援 TLS 1.0 和 1.1

四款主流瀏覽器不再支援 Transport Layer Security (運輸層安全性，TLS) 1.0 和 1.1。

您需要知道的事項

此變更不會影響您的 DigiCert 憑證。您的憑證一如以往持續運作。

此變更影響依賴瀏覽器的服務和依賴 TLS 1.0 或 1.1 的應用程式。瀏覽器的 TLS 1.0 或 1.1 支援一結束時，任何過期的系統將無法進行 HTTPS 連線。

您需要做的事項

SSL/TLS如果您受到此變更影響，而且您的系統支援更新版本的 TLS 通訊協議，請盡快將您的伺服器組態升級至 TLS 1.2 或 TLS 1.3。

如果您未升級至 TLS 1.2 或 1.3，您的網頁伺服器、系統或代理程式將無法使用 HTTPS 與憑證安全的通訊。

瀏覽器 TLS 1.0/1.1 取代資訊

Firefox 78，2020 年 6 月 30 日發佈

Safafi 13.1，2020 年 3 月 24 日發佈

https://developer.apple.com/documentation/safari-release-notes/safari-13_1-release_notes

Chrome 84，2020 年 7 月 21 日發佈

Edge v84，2020 年 7 月 16 日發佈

實用資源

由於有如此多的唯一系統依賴 TLS，因此我們無法涵蓋所有升級路徑，但在此有些可能有幫助的參考：

若要升級到您的 Linux OpenSSL 程式庫，請參閱 https://blog.midtrans.com/time-to-upgrade-to-tls-version-1-2/。
若要啟用 TLS 1.2 搭配 OpenSSL 和 Apache，請參閱 https://serverfault.com/questions/314858/how-to-enable-tls-1-1-and-1-2-with-openssl-and-apache。
若要在 Windows (Windows Server 2012、Windows 7 Service Pack 1 (SP1) 和 Windows Server 2008 R2 SP1) 的 WinHTTP 中啟用 TLS 1.2，請參閱 https://support.microsoft.com/en-us/help/3140245/update-to-enable-tls-1-1-and-tls-1-2-as-default-secure-protocols-in-wi.
若要在 Windows Server 2019 IIS 中停用支援 TLS 1.0 和 1.1，請參閱 https://medium.com/@rootsecdev/configuring-secure-cipher-suites-in-windows-server-2019-iis-7d1ff1ffe5ea。

CertCentral Services API：更新錯誤訊息文件

在 Services API 文件中，我們已更新了錯誤頁面，納入錯誤訊息相關說明：

立刻發行 DV 憑證
網域控制驗證 (DCV)
憑證授權機關授權 (CAA) 資源記錄檢查

今年稍早時，我們改進了 DV 憑證訂單和 DCV 要求的 API，在 DCV、檔案授權、DNS 查詢或 CAA 資訊記錄檢查失敗時，提供更詳細的錯誤訊息。現在，當您收到這些錯誤訊息之一時，請查看「錯誤」頁面以取得更多疑難排解資訊。

如需更多資訊：

七月 31, 2019

DCV IPv4 IP addresses HTTP Practical Demonstration IPv6 compliance

業界標準變更

2019 年 7 月 31 日 (UTC 時間 19:30)，您必須使用 HTTP 現實論證 DCV 方法，證明有您的憑證訂單上的 IP 位址的控制權。

如需更多有關 HTTP 現實論證 DCV 方法的資訊，請參閱這些指示：

目前，所使用的業界標準允許您使用其他 DCV 方法，證明有您的 IP 位址的控制權。但在通過 Ballot SC7 後，IP 位址驗證的法規已變更。

Ballot SC7：更新 IP 位址驗證方法

此次投票重新定義了驗證客戶對憑證中所列的 IP 位址的控制權的流程和程序。Ballot SC7 的遵規變更在 2019 年 7 月 31 日 (UTC 時間 19:30) 生效。

若要保持相容，在 2019 年 7 月 31 日 (UTC 時間 19:30)，DigiCert 僅允許客戶使用 HTTP 現實論證 DCV 方法驗證他們的 IP 位址。

移除對 IPv6 的支援

2019 年 7 月 31 日 (UTC 時間 19:30)，DigiCert 已移除對 IPv6 位址的憑證支援。由於伺服器的限制，DigiCert 無法連線到 IPv6 位址，以確認放置在客戶網站的檔案是否適用 HTTP 現實論證 DCV 方法。

一月 10, 2019

certificate DCV certcentral-ui bug fix

我們修復了其中的 SSL/TLS 憑證訂單編號詳細資料頁面和訂單詳細資料面板在您完成驗證您的憑證訂單上的網域後，未顯示正在完成網域控制驗證的漏洞。

註：此漏洞未在您完成網域控制驗證後，停止發行您的憑證訂單。

現在，當您完成您訂單上的網域的網域控制驗證時，用於訂單的訂單編號詳細資料頁面和訂單詳細資料面板會將網域驗證顯示為正在完成。

(在資訊看板功能表中，按一下憑證 > 訂單。在訂單頁面的憑證訂單的訂單編號欄中，按一下訂單編號或快速檢視連結。)