二月 5, 2021
CertCentral: Improved Organizations page
To make it easier to find your organizations on the Organization page, we now display three new pieces of information about each organization. This additional information is helpful when you have organizations with similar or identical names:
- ID
- Assumed name (if used)
- Address
On the Organizations page, you will now see an Org # column with the organization's ID. You will also see the organization addresses displayed below the names. And, if you use the organization's assumed name, you will see it in parentheses next to the organization name.
Note: Previously, the only way to view this information was to click the organization name and open the organization's details page.
For more information about organizations in CertCentral, see Manage organizations.
CertCentral: Improved add organization option on OV/EV certificate request forms
To make it easier to order a TLS/SSL certificate for an organization in your account, we updated the Add organization option in the OV and EV certificate request forms.
For accounts that issue certificates for 10 or more organizations, we now display three new pieces of organization information. This information is helpful when you have organizations with similar or identical names:
- Assumed name (if used)
- Organization ID
- Address
We also added the ability to type the name of the organization you are searching for.
See for yourself
The next time you request an OV or EV TLS/SSL certificate, click Add organization. In the Organization dropdown, you will see the following organization information: name, assumed name (if used), ID, and address. You can also type the organization name.
一月 25, 2021
CertCentral Services API: Improved Domain emails endpoint
To make it easier to find the DNS TXT email addresses that receive validation emails from DigiCert for email-based domain control validation (DCV), we added a new response parameter to the Domain emails endpoint: dns_txt_emails.
The dns_txt_emails parameter returns a list of email addresses found in the DNS TXT record for the domain. These are the email addresses we find in the DNS TXT record on the _validation-contactemail subdomain of the domain being validated.
Example response with new parameter:
To learn more about the newly supported email to DNS TXT contact DCV method:
For information about validating the domains on DV certificate orders:
For information about validating the domains on OV/EV certificate orders:
一月 13, 2021
CertCentral: Email to DNS TXT contact DCV method
We are happy to announce that DigiCert now supports sending an email to a DNS TXT contact for email-based domain control validation (DCV). This means you can add email addresses to the DNS TXT record for your domain. DigiCert automatically searches the DNS TXT records and sends the DCV email to those addresses. An email recipient needs to follow the instructions in the email to demonstrate control over the domain.
Note: Previously, DigiCert only sent DCV emails to WHOIS-based and constructed email addresses.
Industry changes
Contact information is becoming increasingly inaccessible in WHOIS records due to privacy policies and other constraints. With the passing of Ballot SC13, the Certificate Authority/Browser (CA/B) forum added Email to DNS TXT contact to the list of supported DCV methods.
DNS TXT record email contacts
To use email to Email to DNS TXT contact DCV method, you must place the DNS TXT record on the _validation-contactemail subdomain of the domain you want to validate. DigiCert automatically searches WHOIS and DNS TXT records and sends the DCV email to the addresses found in those records.
_validation-contactemail.example.com | Default | validatedomain@digicerttest.com
The RDATA value of this text record must be a valid email address. See section B.2.1 DNS TXT Record Email Contact in the Appendix of the baseline requirements.
For more information about Ballot SC13, the CA/Browser forum, and the email to DNS TXT contact DCV method:
十一月 3, 2020
CertCentral Services API: Added DCV tokens for new domains to response data for OV and EV certificate orders
We've updated the endpoints for ordering public OV and EV SSL certificates to return the domain control validation (DCV) request tokens for new domains on the order.
Now, when you request an OV or EV certificate, you no longer have to issue separate requests to get the DCV request tokens for the new domains on the order. Instead, you can get the tokens directly from the response data for the order request.
Example response data:
Note: The dcv_token object is not returned for domains that will be validated under the scope of another domain on the order, for domains that already exist in your account, or for subdomains of existing domains.
This update applies to the following endpoints:
十月 13, 2020
ICA certificate chain selection for public OV and EV flex certificates
We are happy to announce that public OV and EV certificates with flex capabilities now support Intermediate CA certificate chain selection.
You can add an option to your CertCentral account that enables you to control which DigiCert ICA certificate chain issues your public OV and EV "flex" certificates.
This option allows you to:
- Set the default ICA certificate chain for each public OV and EV flex certificate.
- Control which ICA certificate chains certificate requestors can use to issue their flex certificate.
Configure ICA certificate chain selection
To enable ICA selection for your account, contact your account manager or our Support team. Then, in your CertCentral account, on the Product Settings page (in the left main menu, go to Settings > Product Settings), configure the default and allowed intermediates for each type of OV and EV flex certificate.
For more information and step-by-step instructions, see ICA certificate chain option for public OV and EV flex certificates.
DigiCert Services API support for ICA certificate chain selection
In the DigiCert Services API, we made the following updates to support ICA selection in your API integrations:
- Created new Product limits endpoint
Use this endpoint to get information about the limits and settings for the products enabled for each division in your account. This includes ID values for each product's default and allowed ICA certificate chains. - Added support for ICA selection to public TLS OV and EV flex certificate order requests
After you configure allowed intermediates for a product, you can select the ICA certificate chain that should issue your certificate when you use the API to submit an order request.
Pass in the ID of the issuing ICA certificate as the value for theca_cert_idparameter in the body of your order request
Example flex certificate request:
For more information about using ICA selection in your API integrations, see OV/EV certificate lifecycle – (Optional) ICA selection.
六月 3, 2020
CertCentral: Automatic DCV checks – DCV polling
We are happy to announce we've improved the domain control validation (DCV) process and added automatic checks for DNS TXT, DNS CNAME, and HTTP practical demonstration (FileAuth) DCV methods.
This means, once you've placed the fileauth.txt file on your domain or added the random value to your DNS TXT or DNS CNAME records, you don't need to worry about signing in to CertCentral to run the check yourself. We will run the DCV check automatically. Although, you can still run a manual check, when needed.
DCV polling cadence
After submitting your public SSL/TLS certificate order, submitting a domain for prevalidation, or changing the DCV method for a domain, DCV polling begins immediately and runs for one week.
- Interval 1—Every minute for the first 15 minutes
- Interval 2—Every five minutes for an hour
- Interval 3—Every fifteen minutes for four hours
- Interval 4—Every hour for a day
- Interval 5—Every four hours for a week*
*After Interval 5, we stop checking. If you have not placed the fileauth.txt file on your domain or added the random value to your DNS TXT or DNS CNAME records by the end of the first week, you will need to run the check yourself.
For more information about the supported DCV methods:
三月 27, 2019
我們已新增新的憑證設定檔選項 OCSP Must-Staple，允許您在 OV 和 EV SSL/TLS 憑證中納入 OCSP Must-Staple 延伸。一針對您的帳戶啟用後，在憑證中納入 OCSP Must-Staple 延伸選項會出現在其他憑證選項下的您的 SSL/TLS 憑證申請表上。
註：支援 OCSP must-staple 的瀏覽器可顯示封鎖插入使用者存取您的網站。確保您的網站正確設定，並在安裝憑證前穩定服務裝訂的 OCSP 回應。
若要啟用您的帳戶的憑證設定檔，請聯絡您的客服代表，或聯絡我們的支援團隊。
其他可用的憑證設定檔選項
如果對您的帳戶啟用，這些設定檔選項會出現在您在其他憑證選項下的 SSL/TLS 憑證申請表上。
- Intel vPro EKU
允許您納入 OV SSL/TLS 憑證中的 Intel vPro EKU 欄位。 - KDC/SmartCardLogon EKU
允許您在 OV SSL/TLS 憑證中納入 KDC/SmartCardLogon EKU (延伸金鑰使用)。 - HTTP Signed Exchange (HTTP 簽署的交換)
允許您納入 OV 和 EV SSL/TLS 憑證中的 CanSignHTTPExchanges 延伸 (請參閱以 Signed HTTP Exchange (簽署的 HTTP 交換) 改良您的 AMP URL)。 - Delegated Credentials (委派的認證)
允許您在 OV 和 EV SSL/TLS 憑證中納入 DelegationUsage 延伸。
三月 26, 2019
我們已新增新的憑證設定檔選項 Delegated Credentials，允許您在 OV 和 EV SSL/TLS 憑證中納入 DelegationUsage 延伸。一針對您的帳戶啟用後，在憑證中納入 DelegationUsage 延伸選項會出現在其他憑證選項下的您的 SSL/TLS 憑證申請表上。
若要啟用您的帳戶的憑證設定檔，請聯絡您的客服代表，或聯絡我們的支援團隊。
背景
Delegated Credentials for TLS 延伸在網際網路工程任何組 (IETF) 的現行開發下，為了支援互相操作性測試，我們已新增發行我們已新增發行符合目前的草稿規格的憑證的功能。請注意，隨著業界持續開發，可能對草稿進行多項變更。
其他可用的憑證設定檔選項
如果對您的帳戶啟用，這些設定檔選項會出現在您在其他憑證選項下的 SSL/TLS 憑證申請表上。
- Intel vPro EKU
允許您納入 OV SSL/TLS 憑證中的 Intel vPro EKU 欄位。 - KDC/SmartCardLogon EKU
允許您在 OV SSL/TLS 憑證中納入 KDC/SmartCardLogon EKU (延伸金鑰使用)。 - HTTP Signed Exchange (HTTP 簽署的交換)
允許您納入 OV 和 EV SSL/TLS 憑證中的 CanSignHTTPExchanges 延伸 (請參閱以 Signed HTTP Exchange (簽署的 HTTP 交換) 改良您的 AMP URL)。 - OCSP Must-Staple
允許您在 OV 和 EV SSL/TLS 憑證中納入 OCSP Must-Staple 延伸。
二月 26, 2019
我們增強了 DigiCert Services API 要求端點，讓您可以取得對您的憑證要求的更快速回應。
我們使用於 OV 憑證訂單 (Standard SSL、Secure Site SSL 等) 的新增聯絡人變得更容易。現在當您訂購 OV 憑證時，我們會為您填入組織聯絡人。需要時，您可以新增技術聯絡人。
- 新增包含您帳戶中的現有組織的 CSR 時，我們會以指派給該組織的聯絡人填入組織聯絡人卡片中。
- 手動新增現有的組織時，我們會以指派給該組織的聯絡人填入組織聯絡人卡片中。
- 新增新組織時，我們會以您的聯絡人資料填入組織聯絡人卡片中。
若要使用不同的組織聯絡人，請刪除自動填入的一個，然後手動新增一個。
我們使用於 EV 憑證訂單 (EV SSL、Secure Site EV SSL 等) 的新增聯絡人變得更容易。現在當您訂購 EV 憑證時，若您的帳戶有可用的 EV 已確認聯絡人資料，我們將為您填入已確認聯絡人卡片。需要時，您可以新增組織和技術聯絡人。
- 新增包含您帳戶中的現有組織的 CSR 時，我們會以指派給該組織的 EV 已確認聯絡人填入已確認聯絡人卡片中。
- 當您手動新增現有的組織時，我們會以指派給該組織的 EV 已確認聯絡人填入已確認聯絡人卡片中。
指派已確認聯絡人給組織不是新增組織的先決條件。有一些確認聯絡人資料不會用於組織的情況。在此情況中，請手動新增已確認聯絡人。
