DigiCert CertCentral

No entries match these filters. Clear filters

1. changelog Oct 30, 2026 · issue 125

   DigiCert CertCentral: Check supported ICA chains per product via the Product info API's allowed_ca_certs field; if absent, ICA selection is not enabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • When ordering through the CertCentral Europe Services API (https://certcentral.digicert.eu/services/v2), omitting the optional ca_cert_id parameter on a product set to the DigiCert default ICA chain triggers automatic key-type matching between the ICA chain and the CSRCSRA Certificate Signing Request is a block of encoded data submitted to a certificate authority, containing a public key and identity details, so the CA can issue a signed TLS certificate without ever seeing the private key..

   1 more in Everything

2. October 27, 2026 Oct 27, 2026 · issue 123

   CertCentral Europe now auto-matches ICA chain key type to CSRCSRA Certificate Signing Request is a block of encoded data submitted to a certificate authority, containing a public key and identity details, so the CA can issue a signed TLS certificate without ever seeing the private key. key type, with warnings on mismatches for products with ICA selection enabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Verify whether ICA selection is enabled for a specific product and check its default chain before ordering, to know whether automatic key-type matching will apply.
   📍In CertCentral Europe, go to Settings › Product Settings. Select the product (e.g. Basic OV). Look for the 'Allowed intermediate chains [Intermediate CA] › [Root CA]' menu. If present, check the Default intermediate chain value: DigiCert default means auto key-type matching applies; a specific chain (e.g. 'DigiCert Global G3 TLS ECC SHA384 2020 CA1 (SHA384ECDSA) › DigiCert Global Root G3 (SHA384ECDSA)') means a mismatch warning may appear if your CSR key type differs.
   • CertCentral Europe automatically selects an ICA chain whose key type matches the CSR key type when a product's default ICA chain is set to DigiCert default, for products with ICA selection enabled that support both RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. and ECC.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • CertCentral Europe shows a key-type mismatch warning on the request form when a specific ICA chain is selected whose key type differs from the CSR key type, while still allowing order submission with a mixed chain (e.g. ECC certificate with RSA ICA chain).
   • The Intermediate chains [Intermediate CA] > [Root CA] menu on the request form lets practitioners select a matching ICA chain or proceed with a mixed chain when a mismatch warning appears.
   • Administrators can verify ICA selection status and default chain per product via Settings > Product Settings and the Allowed intermediate chains and Default intermediate chain menus in CertCentral Europe.
   • CertCentral Europe automatically selects an ICA chain whose key type matches the CSR key type when a product's default ICA chain is set to DigiCert default, for products with ICA selection enabled that support both RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it. and ECC.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • CertCentral Europe shows a key-type mismatch warning on the request form when a specific ICA chain is selected whose key type differs from the CSR key type, while still allowing order submission with a mixed chain (e.g. ECC certificate with RSA ICA chain).

   2 more in Everything

3. changelog Oct 20, 2026 · issue 114

   CertCentral adds a DigiCert default (recommended) chain menu option, cleans Apache certificate bundles, and deprecates the disable_ct API parameter.

   • Adds DigiCert default (recommended) option to the Default intermediate chain product menu so operators can distinguish a DigiCert-chosen chain from one they explicitly selected; the ca_cert_id API parameter continues to override this setting per-request.
   • Apache download (DigiCertCA.crt) for G5 and G2 TLS certificates will no longer include the unneeded self-signed root — only the cross-signed root remains, removing the need for manual post-download cleanup scripts.
   • The disable_ct parameter on certificate order requests (including Order Basic OV) is deprecated; CertCentral now ignores it and always logs issued TLS certificates to CT logs regardless of the value passed.

   3 details in Everything

   • New supported platform G5 TLS root hierarchy transition
   └──▷ BREAKING ON UPGRADE

   • !Scripts that remove a certificate by position in the Apache DigiCertCA.crt file, or that expect a specific number of certificates in the file, will break after October 20, 2026 — update scripts to remove the self-signed root only if present and always retain the cross-signed root.
   • !The disable_ct parameter is ignored as of this change: requests that set disable_ct to true to suppress CT logging will no longer have that effect — certificates will be logged to CT logs unconditionally.
   • !Starting November 12, 2026, new browser-trusted TLS orders, renewals, reissues, and duplicates will default to G5 root hierarchies; accounts relying on Global G2 or G3 intermediate chains must explicitly select those chains via the Default intermediate chain menu or the ca_cert_id API parameter before that date.
4. November 12, 2026 Oct 15, 2026 · issue 129

   DigiCert CertCentral now enforces DCVDCVDomain Control Validation, a certificate-authority process that proves an applicant controls a domain before issuing a TLS certificate; cyber tools use it to automate certificate provisioning workflows. method settings on API requests, returning structured errors for disallowed methods⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Verify which DCV methods your account permits before automated API certificate orders break on the new enforcement.
   📍In CertCentral, go to Settings › Preferences. On the Preferences page, expand Advanced Settings. Under Domain Control Validation (DCV), review DCV methods (ensure every method used by your API integrations is checked) and Set default DCV method (the fallback when dcv_method is omitted). Select Save Settings.
   • API requests that include a DCV method not enabled in your account now return invalid_value (on order or add-domain requests) or dcv_method_not_allowed (on DCV method changes) instead of silently succeeding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • CertCentral's DCV methods setting under Settings > Preferences > Advanced Settings > Domain Control Validation now governs which values are accepted in the dcv_method parameter across all affected Services API endpoints — order endpoints, Change DCV method (pending orders), Add domain, and Change DCV method (domain validation).
   • DigiCert CertCentral now issues all browser-trusted TLS certificates (DV, OV, and EV) from the G5 root hierarchies — DigiCert TLS RSA4096 Root G5 and DigiCert TLS ECC P384 Root G5 — by default across DigiCert, GeoTrust, Thawte, RapidSSL, and Encryption Everywhere brands.
   • API requests that include a DCV method not enabled in your account now return invalid_value (on order or add-domain requests) or dcv_method_not_allowed (on DCV method changes) instead of silently succeeding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !API requests that pass a dcv_method value not enabled in the account's DCV methods configuration now receive an invalid_value or dcv_method_not_allowed error rather than being accepted; any Services API integration using a DCV method that is not selected in Settings > Preferences > Advanced Settings > Domain Control Validation will break.
   • !All new TLS certificate orders, renewals, reissues, and duplicates are now issued from DigiCert TLS RSA4096 Root G5 or DigiCert TLS ECC P384 Root G5; trust stores, hard-coded root or intermediate CA certificate trust, and pinned certificates that do not include the G5 roots and intermediates will cause service disruptions.
5. October 20, 2026 Oct 15, 2026 · issue 110

   CertCentral Apache download drops unneeded self-signed G5/G2 roots; Default intermediate chain menu gains a DigiCert default (recommended) option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Verify your product is pinned to a specific intermediate chain — not the rolling DigiCert default — before the November 12, 2026 G5 migration changes it.
   📍In CertCentral, go to Settings › Product Settings. Select the certificate product. In the Default intermediate chain menu, check whether it shows DigiCert default (recommended). If it does and you need a fixed chain, select your preferred chain and click Save Settings.
   • The Default intermediate chain menu in Settings > Product Settings now shows a DigiCert default (recommended) option so you can distinguish DigiCert's default chain from a chain you explicitly selected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Apache .crt download files for G5 and G2 TLS certificates will contain only the intermediate CA and cross-signed root — the self-signed G5 and G2 roots are removed from DigiCertCA.crt.
   • The Default intermediate chain menu in Settings > Product Settings now shows a DigiCert default (recommended) option so you can distinguish DigiCert's default chain from a chain you explicitly selected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !As of October 20, 2026, the Apache DigiCertCA.crt file for G5 and G2 TLS certificates drops from three certificates to two (intermediate CA and cross-signed root only). Scripts that remove a certificate by position or that expect a specific certificate count will break.
6. November 12, 2026 Oct 15, 2026 · issue 109

   DigiCert transitions all browser-trusted TLS certificate issuance to G5 root hierarchies (RSA4096 and ECC P384ECC P384An elliptic curve defined by NIST operating over a 384-bit prime field, used in public-key cryptography to provide roughly 192-bit security strength with smaller keys than RSA.) on November 12, 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Switches default TLS certificate issuance — new orders, renewals, reissues, and duplicates — to DigiCert TLS RSA4096 Root G5 and DigiCert TLS ECC P384 Root G5 root hierarchies across all DigiCert, GeoTrust, Thawte, RapidSSL, and Encryption Everywhere brands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Applies to all browser-trusted DV, OV, and EV TLS certificates for all public TLS customers; certificate chains may include server, intermediate CA, and cross-signed root certificates.
   • Customers managing custom trust stores must add and trust the G5 root and intermediate CA certificates to maintain service continuity.
   • Switches default TLS certificate issuance — new orders, renewals, reissues, and duplicates — to DigiCert TLS RSA4096 Root G5 and DigiCert TLS ECC P384 Root G5 root hierarchies across all DigiCert, GeoTrust, Thawte, RapidSSL, and Encryption Everywhere brands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !All newly issued, renewed, reissued, and duplicate TLS certificates will chain to DigiCert TLS RSA4096 Root G5 or DigiCert TLS ECC P384 Root G5 starting November 12, 2026 — any trust store, pinned root, or hard-coded intermediate CA certificate that does not include the G5 roots and ICAs will fail validation and cause service disruptions.
7. October 15, 2026 seen Oct 8, 2026 · issue 097

   CertCentral defaults to G5 RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it./ECC roots for all TLS issuance and trims self-signed roots from Apache downloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Preview the updated Apache bundle content for a G5-issued order directly in CertCentral before updating automation.
   📍In CertCentral, go to Certificates › Orders, select the order number of a TLS certificate issued from a G5 intermediate CA, then in the Download certificate as menu select '.crt (best for Apache / Linux)' and inspect DigiCertCA.crt to confirm it contains two certificates.
   • Switches default TLS certificate issuance (new orders, renewals, reissues, and duplicates) to DigiCert TLS RSA4096 Root G5 and DigiCert TLS ECC P384 Root G5 for all DV, OV, and EV certificates across DigiCert, GeoTrust, Thawte, RapidSSL, and Encryption Everywhere brands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !Scripts or automation that remove the extra self-signed root from the Apache download file, or that expect a specific number of certificates in DigiCertCA.crt, will break after October 15, 2026: the file now contains two certificates (intermediate CA and cross-signed root) instead of three.
   • !Trust stores that do not already include DigiCert TLS RSA4096 Root G5 and DigiCert TLS ECC P384 Root G5 must add and trust those roots, or newly issued certificates will fail validation.
   • !Hard-coded or pinned root/intermediate CA certificate trust will break as issuance moves to G5 hierarchies — policies requiring hard-coding or pinning must be removed.
8. announced Sep 27, 2026 · issue 089

   DigiCert AI Trust Manager now issues AI Passports for agents running in NVIDIA OpenShell, adding cryptographic identity and a kill switch.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds AI Passport issuance for every agent, model, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server running inside an NVIDIA OpenShell sandbox, providing cryptographic PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets.-rooted identity that OpenShell policy can act on instead of a name in a config file.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds signing and scanning of agents, models, and MCP servers with an AI Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (AIBOMAIBOMAn inventory of every AI model, dataset, and dependency used in a system, analogous to a software bill of materials, giving cyber tools a structured way to audit AI supply-chain risk.) before a sandbox launches them.
   • Adds signed, auditable records anchored to the DigiCert AI Root of Trust for every OpenShell allow/deny decision, with confidential-compute attestation attached where applicable.
   • Adds a policy-based, automated, enforceable kill switch — powered by AI Passport identity — that lets customers stop any agent for any reason across organizational boundaries.

   4 details in Everything

9. changelog Sep 26, 2026 · issue 086

   DigiCert CertCentral: Adds Persistent DNS TXTDNS TXTA DNS record type that stores arbitrary text strings in a domain's zone data, often used by cyber tools to exfiltrate data, verify domain ownership, or publish policy information like SPF and DMARC. automatic domain revalidation: CertCentral revalidates domains via the Persistent DNS TXT DCVDCVDomain Control Validation, a certificate-authority process that proves an applicant controls a domain before issuing a TLS certificate; cyber tools use it to automate certificate provisioning workflows. method every five days, eliminating the need to manually resubmit domains before the nine-day revalidation window expires.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Set up Persistent DNS TXT automatic domain revalidation in CertCentral so domains stay continuously validated without manual intervention.
   📍In CertCentral, go to Domains, select the domain you want to prevalidate, choose the Persistent DNS TXT Record DCV method, place the persistent URI TXT record in your DNS zone, and submit for validation. Once validated, leave the TXT record in place — CertCentral will revalidate the domain automatically every five days.
   └──▷ BREAKING ON UPGRADE

   • !All new TLS certificate orders, renewals, reissues, and duplicates will be issued from DigiCert TLS RSA4096 Root G5 or DigiCert TLS ECC P384 Root G5 by default as of October 15, 2026 — customers managing trust stores, hard-coding CA certificate trust, or pinning root/intermediate CA certificates must update their configurations or face service disruptions.
   • !MPICMPICMulti-Perspective Issuance Corroboration, a CA/Browser Forum requirement that certificate authorities verify domain control from multiple network vantage points to reduce BGP hijack and DNS manipulation risks during certificate issuance. enforcement as of December 1, 2026 requires that DNS queries and website traffic be reachable from six remote network perspectives across at least two RIR regions — environments that restrict traffic by IP address, region, query volume, or rate may block validation and must be reconfigured.
10. changelog Sep 25, 2026 · issue 085
    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Set up the Persistent DNS TXTDNS TXTA DNS record type that stores arbitrary text strings in a domain's zone data, often used by cyber tools to exfiltrate data, verify domain ownership, or publish policy information like SPF and DMARC. record so CertCentral can automatically revalidate your domain every five days without manual intervention.
    📍In CertCentral, go to Domains, select your domain, choose Persistent DNS TXT Record as the DCV method, add the displayed TXT record to your DNS zone, and submit for initial validation. Leave the record in place permanently — CertCentral will revalidate the domain on its five-day cycle automatically.
    └──▷ BREAKING ON UPGRADE

    • !TLS certificate issuance now defaults to the G5 root hierarchies (DigiCert TLS RSA4096 Root G5 and DigiCert TLS ECC P384 Root G5); customers managing trust stores, hard-coding root or intermediate CA certificate trust, or pinning root or intermediate CA certificates must update their configurations or face service disruptions.
    • !MPICMPICMulti-Perspective Issuance Corroboration, a CA/Browser Forum requirement that certificate authorities verify domain control from multiple network vantage points to reduce BGP hijack and DNS manipulation risks during certificate issuance. now requires six remote network perspectives and four corroborations per domain query; customers restricting DNS queries or website traffic by IP address, region, query volume, or rate must verify their configurations support MPIC traffic from six remote perspectives.
11. changelog Sep 24, 2026 · issue 084

    CertCentral adds Persistent DNS TXTDNS TXTA DNS record type that stores arbitrary text strings in a domain's zone data, often used by cyber tools to exfiltrate data, verify domain ownership, or publish policy information like SPF and DMARC. automatic domain revalidation and shifts TLS issuance to G5 RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it./ECC roots by default⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Set up Persistent DNS TXT automatic domain revalidation so domains stay continuously validated without manual intervention — useful for teams issuing OV/EV TLS certificates on recurring schedules.
    📍In CertCentral, go to Domains, select the domain you want to keep continuously validated, choose Persistent DNS TXT Record as the DCV method, complete the initial validation, then leave the Persistent DNS TXT record in place with the correct persistent URI value (Account or Unique). CertCentral will revalidate the domain automatically every five days.
    • Shifts default TLS certificate issuance (new orders, renewals, reissues, and duplicates) to DigiCert TLS RSA4096 Root G5 and DigiCert TLS ECC P384 Root G5 hierarchies for all DV, OV, and EV certificates across DigiCert, GeoTrust, Thawte, RapidSSL, and Encryption Everywhere brands.
    • Enforces six remote MPICMPICMulti-Perspective Issuance Corroboration, a CA/Browser Forum requirement that certificate authorities verify domain control from multiple network vantage points to reduce BGP hijack and DNS manipulation risks during certificate issuance. network perspectives across at least two RIR regions for domain control verification and CAA checks, requiring four corroborations per domain query, in compliance with the CA/Browser Forum MPIC requirements effective December 15, 2026.
    • Shifts default TLS certificate issuance (new orders, renewals, reissues, and duplicates) to DigiCert TLS RSA4096 Root G5 and DigiCert TLS ECC P384 Root G5 hierarchies for all DV, OV, and EV certificates across DigiCert, GeoTrust, Thawte, RapidSSL, and Encryption Everywhere brands.

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !TLS certificates (new orders, renewals, reissues, duplicates) will be issued from DigiCert TLS RSA4096 Root G5 and DigiCert TLS ECC P384 Root G5 by default as of October 15, 2026 — customers who hard-code or pin root/intermediate CA certificates, or manage their own trust stores, must add and trust the G5 root and intermediate CA certificates or face service disruptions.
    • !MPIC enforcement as of December 1, 2026 increases to six remote network perspectives requiring four corroborations — environments that restrict DNS queries or website traffic by IP address, region, query volume, or rate must verify their configurations support MPIC traffic from six remote perspectives or certificate issuance may fail.
12. September 22, 2026 Sep 22, 2026 · issue 083

    CertCentral now auto-revalidates domains via Persistent DNS TXT Record DCVDNS TXT Record DCVA domain control validation method where a certificate authority asks you to publish a specific value in a DNS TXT record, proving you control the domain before issuing a TLS certificate. every five days, preventing expired validations from blocking certificate issuance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ HOW TO FIND IT
    Enroll a domain in automatic 5-day revalidation so certificate issuance is never delayed by an expired domain validation — do this once via the CertCentral Domains page.
    📍In CertCentral, go to Domains, add or select your domain, choose Persistent DNS TXT Record as the DCV method, complete the initial validation, then leave the DNS TXT record with the correct persistent URI value (Account or Unique) in place. DigiCert will revalidate the domain automatically every five days.
    • Adds automatic domain revalidation using the Persistent DNS TXTDNS TXTA DNS record type that stores arbitrary text strings in a domain's zone data, often used by cyber tools to exfiltrate data, verify domain ownership, or publish policy information like SPF and DMARC. Record DCVDCVDomain Control Validation, a certificate-authority process that proves an applicant controls a domain before issuing a TLS certificate; cyber tools use it to automate certificate provisioning workflows. method, where DigiCert checks and revalidates domains every five days as long as the Persistent DNS TXT record with the correct persistent URI value (Account or Unique) remains in place.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports automatic revalidation for OV and EV TLS, Qualified Website Authentication Certificates (QWAC), QWAC PSD2, PKIo Private Services Server, and X9 PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. for TLS certificate types — with validated domains added to the Domains page where revalidation runs.
    • Persistent DNS TXT domain validation is reusable for nine days before revalidation is required, with the automatic process eliminating the need to manually resubmit domains before expiry.
    • Adds automatic domain revalidation using the Persistent DNS TXTDNS TXTA DNS record type that stores arbitrary text strings in a domain's zone data, often used by cyber tools to exfiltrate data, verify domain ownership, or publish policy information like SPF and DMARC. Record DCVDCVDomain Control Validation, a certificate-authority process that proves an applicant controls a domain before issuing a TLS certificate; cyber tools use it to automate certificate provisioning workflows. method, where DigiCert checks and revalidates domains every five days as long as the Persistent DNS TXT record with the correct persistent URI value (Account or Unique) remains in place.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports automatic revalidation for OV and EV TLS, Qualified Website Authentication Certificates (QWAC), QWAC PSD2, PKIo Private Services Server, and X9 PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. for TLS certificate types — with validated domains added to the Domains page where revalidation runs.

    1 more in Everything

13. announced Sep 1, 2026 · issue 064

    DigiCert Continuous Validation automates DNS-based domain control validation via UltraDNS, keeping domains ready for certificate issuance without manual steps.

    • New DigiCert Continuous Validation service connects DigiCert Trust Lifecycle Manager to customers' DNS environments through DigiCert UltraDNS to automate continuous DNS-based Domain Control Validation (DCVDCVDomain Control Validation, a certificate-authority process that proves an applicant controls a domain before issuing a TLS certificate; cyber tools use it to automate certificate provisioning workflows.).
    • Monitors domain validation status and automatically refreshes DNS records before validation expires, eliminating manual DCV work between certificate renewals.
    • Automatically removes dangling DNS records after validation completes.
    • Designed for teams managing certificates at scale as TLS validity periods shorten, enabling certificate issuance and renewal workflows to proceed without waiting on manual DNS changes.

    4 details in Everything

14. changelog Aug 31, 2026 · issue 060

    CertCentral adds configurable default Key Usage setting for X9 PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. for TLS certificate request forms.

    ⤢ ⤢ ⤢ ⤢
15. changelog Aug 23, 2026 · issue 054

    CertCentral adds Persistent DNS TXTDNS TXTA DNS record type that stores arbitrary text strings in a domain's zone data, often used by cyber tools to exfiltrate data, verify domain ownership, or publish policy information like SPF and DMARC. record bulk revalidation, X9 PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. multi-year TLS certs, and in-place ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. ICA updates

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Switch an existing ACME Directory URL to a different intermediate CA chain without recreating it — useful when rotating ICA certificates.
    📍In CertCentral, open the ACME Directory URL settings, then navigate to ACME Directory URL Restrictions › Intermediate chains [Intermediate CA] › [Root CA] menu, select the desired certificate chain, and save changes.
    Request a 3-year X9 PKI for TLS certificate for a long-lived internal system to reduce renewal overhead.
    📍In CertCentral, go to Dashboard › Request a Certificate › Request X9 PKI for TLS Certificate, then under Certificate Settings › Validity period, select the 3-year option and complete the order.
    • Adds support for the Persistent DNS TXT record DCVDCVDomain Control Validation, a certificate-authority process that proves an applicant controls a domain before issuing a TLS certificate; cyber tools use it to automate certificate provisioning workflows. method in CertCentral bulk domain revalidation — a one-time DNS TXT record containing a DigiCert-provided persistent URI that is reused on every subsequent revalidation without creating new records or values.
    • Extends X9 PKI for TLS certificate validity options from 397-day maximum to selectable 1-, 2-, or 3-year terms (custom validity capped at 1,095 days), available on the Dashboard under Request a Certificate > Request X9 PKI for TLS Certificate > Certificate Settings > Validity period.
    • Enables updating the issuing intermediate CA (ICA) certificate on an existing ACME Directory URL without creating a new URL — accessible via the ACME Directory URL Restrictions panel using the 'Intermediate chains [Intermediate CA] > [Root CA]' menu.

    3 details in Everything

16. August 18, 2026 Aug 18, 2026 · issue 050

    CertCentral adds Persistent DNS TXTDNS TXTA DNS record type that stores arbitrary text strings in a domain's zone data, often used by cyber tools to exfiltrate data, verify domain ownership, or publish policy information like SPF and DMARC. record bulk revalidation, 2- and 3-year X9 PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. for TLS validity, and in-place ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. Directory URL ICA updates.

    ⤢ ⤢ ⤢ ⤢
    └──▷ HOW TO FIND IT
    Switch an existing ACME Directory URL to a different intermediate CA chain without creating a new URL — useful when rotating ICA certificates across automated issuance pipelines.
    📍In CertCentral, go to Automation › ACME Directory URLs. In the Actions menu for the target URL, select Update ACME Directory URL. Under ACME Directory URL Restrictions, use the 'Intermediate chains [Intermediate CA] › [Root CA]' menu to choose the desired chain, then select Update ACME Directory URL to save.
    Revalidate a batch of domains using the Persistent DNS TXT record method so the same DNS record can be reused on every future revalidation cycle.
    📍In CertCentral, go to Certificates › Domains. Select the domains to revalidate, open the Submit domains for revalidation menu, and choose Revalidation by Persistent DNS TXT record. Follow the on-screen instructions to place the DigiCert-provided persistent URI in your DNS TXT record once, then submit.
    • Adds Revalidation by Persistent DNS TXT record option to the bulk domain revalidation workflow under Certificates > Domains, allowing a one-time DNS TXT record containing a DigiCert-provided persistent URI to be reused for every subsequent domain revalidation — no new record or URI value required each cycle.
    • Extends X9 PKI for TLS certificate validity options from a maximum of 397 days to selectable 1-, 2-, or 3-year terms (custom validity capped at 1,095 days), available in the Validity period section of the Request X9 PKI for TLS Certificate page.
    • Enables updating the issuing intermediate CA (ICA) certificate on an existing ACME Directory URL via Automation > ACME Directory URLs > Actions > Update ACME Directory URL, replacing the previous requirement to create a new ACME Directory URL to change the certificate chain.

    3 details in Everything

17. changelog Aug 15, 2026 · issue 046

    CertCentral adds CSRCSRA Certificate Signing Request is a block of encoded data submitted to a certificate authority, containing a public key and identity details, so the CA can issue a signed TLS certificate without ever seeing the private key.-driven CN/SANs repopulation, DCVDCVDomain Control Validation, a certificate-authority process that proves an applicant controls a domain before issuing a TLS certificate; cyber tools use it to automate certificate provisioning workflows. polling status fields, and Service User name editing.

    ⤢ ⤢ ⤢
    └──▷ USE IT
    Check whether DCV polling is active and when it last ran for a pending certificate order, to decide whether to trigger a manual validation check.
    json copy

    // Example Services API response fragment for a pending order
    {
      "dcv_method": "dns-txt-token",
      "dcv_token": {
        "token": "{{dcv_token}}",
        "status": "pending",
        "expiration_date": "2022-02-24T16:25:52+00:00"
      },
      "dcv_polling_status": true,
      "dcv_polling_last_checked": "2026-07-09T22:07:24Z"
    }

    • Adds dcv_polling_status and dcv_polling_last_checked fields to the Services API responses for certificate requests and DNS name validations, surfacing whether DigiCert's automatic DCV polling is active and when it last ran.
    • Adds a Use CN/SANs from CSR option on certificate request forms (DV, OV, EV TLS; QWAC and QWAC PSD2; X9 PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. for TLS; Private TLS) to replace existing Common Name and SANs fields with values from the uploaded CSR, with an Undo option to revert.
    • Enables updating a Service User's first and last names in CertCentral, making it easier to distinguish Service Users and assign them to teams or operational roles.
    • Simplifies the delegation request workflow by removing the organization selection step — a single delegation request now applies to all organizations the selected approver represents and all certificate products they are authorized to approve.
    • Removes CT logging opt out options from CertCentral, enforcing CT logging on all public TLS certificates (DV, OV, EV, QWAC, QWAC PSD2) across all DigiCert brands.

    +7 more show less

    • Begins DNSSECDNSSECA set of DNS extensions, maintained by the IETF, that add cryptographic signatures to DNS records so resolvers can verify responses have not been tampered with in transit. validation during domain control validation and DNS CAA checks, returning DNSSEC-specific error and status messages in CertCentral order details pages and via the Services API when issues are detected.
    • Updates Multi-Perspective Issuance Corroboration (MPICMPICMulti-Perspective Issuance Corroboration, a CA/Browser Forum requirement that certificate authorities verify domain control from multiple network vantage points to reduce BGP hijack and DNS manipulation risks during certificate issuance.) to require corroboration from at least four remote network locations across at least two different Regional Internet Registry regions.
    • Transitions TLS certificate issuance to DigiCert's X9 PKI hierarchies.
    • Retires the legacy CertCentral ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. service, with legacy ACME credential warnings shown in the ACME credentials table and requests to legacy ACME URLs failing to issue certificates after the retirement date.
    • Moves public TLS certificate maximum validity to 199 days and public code signing certificate maximum validity to 459 days, per CA/Browser Forum requirements.
    • Reduces domain validation and organization validation reuse periods to one day less than the CA/Browser Forum permitted maximums.
    • Announces retirement of CertCentral Discovery and Managed Automation services on October 1, 2026, with capabilities moving to DigiCert Trust Lifecycle Manager.

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Public TLS certificates will no longer be issued with the Client Authentication EKU; existing workflows that depend on this EKU on newly issued certificates will break.
    • !CT logging opt-out options are removed from CertCentral — certificates that previously needed to be kept out of CT logs can no longer be issued that way from June 1, 2026 onward.
    • !Requests to legacy ACME URLs will fail to issue a certificate after the legacy CertCentral ACME service retirement date; legacy credentials must be replaced with new CertCentral ACME credentials.
    • !CertCentral Discovery and Managed Automation services retire on October 1, 2026 — integrations relying on these services will stop working.
    • !TLS certificate validity is capped at 199 days and code signing certificate validity at 459 days; orders requesting longer validity periods will be rejected or truncated.
    • !DNSSEC validation is now enforced during DCV and CAA checks — domains with misconfigured DNSSEC will block certificate issuance until the configuration is resolved.
    • !MPIC now requires corroboration from at least four remote network locations across at least two RIR regions — certificate issuance fails if more than one perspective does not corroborate.
18. August 11, 2026 Aug 11, 2026 · issue 043

    CertCentral adds Use CN/SANs from CSR option to replace Common name and SANs on certificate request forms

    ⤢ ⤢ ⤢
19. changelog seen Jul 31, 2026 · issue 031

    CertCentral adds DCVDCVDomain Control Validation, a certificate-authority process that proves an applicant controls a domain before issuing a TLS certificate; cyber tools use it to automate certificate provisioning workflows. polling status to APIs, ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. URL delegation/transfer, API key transfer, and broader automated delegation approvals.

    └──▷ HOW TO FIND IT
    Transfer an API key tied to a departing user to a Service User before deleting the account, keeping integrations uninterrupted.
    📍In CertCentral, go to the API Keys page, find the API key and select its link. In the Update API Key window, use the owner menu to select the target Service User, then click Update API Key.
    Create an ACME Directory URL for a new Service User so ACME credentials are not tied to an individual employee account.
    📍In CertCentral, go to the ACME Directory URLs page, select Add ACME Directory URL, enter a Name for the URL, choose a product from the product menu, add the new Service User's details, and finish configuring the URL.
    • Enables Administrators to transfer API key ownership to another CertCentral user or Service User, keeping transferred keys valid until revoked or deactivated.
    • Simplifies delegation request workflow by removing the organization selection step — a single delegation request now applies to all organizations the approver represents across all authorized certificate products.
    • Extends automated delegation approval support in CertCentral Europe to a broader set of PKIo and EU Qualified certificate products.

    3 details in Everything

20. July 29, 2026 Jul 29, 2026 · issue 030

    CertCentral automated delegation approval expands to EV TLS, EV Code Signing, Verified Mark, and PKIo products globally and in Europe.

    └──▷ HOW TO FIND IT
    Delegate approval authority to a CertCentral user so future EV TLS or EV Code Signing orders are issued automatically without manual intervention.
    📍In CertCentral, go to Account › Users. Select the target user. On the user details page, under Order approval delegation, select Request delegation. In the Submit a delegation request window, select the authorized representative or verified contact, then select Submit Request.
    • Extends automated delegation approval to EV TLS, EV Code Signing, Code Signing, Verified Mark, and Common Mark certificates in CertCentral global and Europe.
    • Adds automated delegation approval support for a broad set of CertCentral Europe products including EU Qualified eSeal (PSD2), EU Qualified Website Authentication Certificate (PSD2), PKIo Personal Organisation, PKIo Qualified eSeal, PKIo Private Person, and multiple PKIo Authentication/Encryption and Private Services Server variants.
    • Simplifies the delegation request workflow: a single request now covers all organizations the selected approver represents and all certificate products they are authorized to approve, removing the previous per-organization selection step.
    • Enables fully automated certificate issuance via CertCentral UI and Services API once a delegated approver is assigned, eliminating repeated manual approvals per order.

    4 details in Everything

21. July 28, 2026 Jul 28, 2026 · issue 029

    CertCentral adds DCVDCVDomain Control Validation, a certificate-authority process that proves an applicant controls a domain before issuing a TLS certificate; cyber tools use it to automate certificate provisioning workflows. polling status to APIs, ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. URL delegation to Service Users, and API key ownership transfers.

    └──▷ TRY IT
    Check whether automatic DCV polling is still active for a domain, so you know if a manual validation check is needed.
    copy

    $ curl -X GET 'https://www.digicert.com/services/v2/domain/<domain_id>' \
      -H 'X-DC-DEVKEY: <api_key>' \
      -H 'Content-Type: application/json'
    # Look for dcv_polling_status and dcv_polling_last_checked in the response

    Transfer an ACME Directory URL to a Service User before offboarding an employee, so automations keep running without re-issuing credentials.
    📍In CertCentral, go to Automation › ACME Directory URLs. Find the URL, open its Actions menu, and select Update ACME Directory URL. In the Update ACME Directory URL restrictions window, use the User menu to select the target Service User, then select Update ACME Directory URL.
    Transfer an API key to a Service User before deleting a user whose key is embedded in active integrations.
    📍In CertCentral, go to Automation › API Keys. Find the API key and select its link. In the Update API Key window, use the User menu to select the CertCentral user or Service User to transfer ownership to, then save.
    • Adds dcv_polling_status and dcv_polling_last_checked fields to the Domain info and Order validation status API endpoints, exposing whether automatic DCV polling is active and when it last ran.
    • Enables creating ACME Directory URLs on behalf of another CertCentral user, Service User, or new Service User — no longer limited to self-service only.
    • Enables transferring ACME Directory URL ownership to another CertCentral user or Service User, decoupling credentials from individual accounts.
    • Enables transferring API key ownership to another CertCentral user or Service User, allowing integrations to survive user departures without credential rotation.

    4 details in Everything

22. July 14, 2026 seen Jul 15, 2026 · issue 015

    CertCentral adds Persistent DNS TXT Record DCVDNS TXT Record DCVA domain control validation method where a certificate authority asks you to publish a specific value in a DNS TXT record, proving you control the domain before issuing a TLS certificate., enabling one-time DNS setup for repeated domain revalidations.

    └──▷ HOW TO FIND IT
    Enable the Persistent DNS TXTDNS TXTA DNS record type that stores arbitrary text strings in a domain's zone data, often used by cyber tools to exfiltrate data, verify domain ownership, or publish policy information like SPF and DMARC. Record DCVDCVDomain Control Validation, a certificate-authority process that proves an applicant controls a domain before issuing a TLS certificate; cyber tools use it to automate certificate provisioning workflows. method for your account so it appears in all DCV method menus.
    📍In the CertCentral menu, go to Settings › Preferences. Expand Advanced Settings. Under Domain Control Validation (DCV) › DCV methods, select Persistent DNS TXT Record. Click Save Settings.
    • Adds Persistent DNS TXT Record as a new domain control validation (DCV) method, allowing a single DNS TXT record to satisfy repeated revalidations without creating new records each cycle.
    • Supports an Account URI option — one shared persistent URI to validate any domain across the entire CertCentral account, simplifying multi-domain DNS management.
    • Supports a Unique URI option — a domain-specific persistent URI to avoid publicly linking domains through shared DNS records.
    • Enables Persistent DNS TXT Record DCV on certificate request forms, the Domains page (add/validate/revalidate), and pending OV, EV, and DV TLS certificate orders once activated in account preferences.

    4 details in Everything

23. July 7, 2026 seen Jul 13, 2026 · issue 014

    CertCentral's Allowed validity periods setting now controls certificate validity (max 199 days), not order validity, with updated TLS request forms.

    └──▷ HOW TO FIND IT
    Restrict which certificate validity durations your team can select when ordering Basic OV TLS certificates.
    📍In the CertCentral console, go to Settings › Product Settings, select Basic OV in the Product column, configure Allowed validity periods under Product Settings, then click Save Settings.
    • Allowed validity periods setting for TLS products now controls certificate validity instead of order validity, capped at the 199-day maximum.
    • Annual plan and Multi-year Plan TLS request forms now show coverage options in years (1-, 2-, 3-year) with custom order validity options removed.
    • For non-Annual/non-Multi-year Plan TLS requests, certificate validity and order validity are now unified (e.g., a 47-day cert creates a 47-day order).
    • Breaking change: any previously configured allowed validity periods exceeding 199 days are automatically removed from TLS product settings.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Allowed validity periods setting in TLS certificate product settings no longer controls order validity; it now controls certificate validity. Any previously configured validity periods greater than 199 days will be automatically removed from the setting.
    • !Customized order validity options have been removed from Annual plan and Multi-year Plan TLS certificate request forms; coverage options now appear only in years (1-, 2-, or 3-year).
    • !For non-Annual plan and non-Multi-year Plan TLS certificate requests, any validity periods greater than 199 days have been removed, and certificate validity now determines order validity.
24. June 1, 2026 seen Jul 13, 2026 · issue 014

    CertCentral enforces CT logging for all public TLS certs and upgrades MPICMPICMulti-Perspective Issuance Corroboration, a CA/Browser Forum requirement that certificate authorities verify domain control from multiple network vantage points to reduce BGP hijack and DNS manipulation risks during certificate issuance. to four remote locations across two RIRs.

    └──▷ HOW TO FIND IT
    Check whether your existing TLS certificates are logged to CT logs before the enforcement deadline using CertCentral's Report Library.
    📍In CertCentral, go to Reports › Report Library, then generate or run a TLS certificate report and filter by CT log status to identify any certificates currently excluded from CT logs.
    • Enforces Certificate TransparencyCertificate TransparencyA public, append-only log system maintained by various operators (Google runs several) that records every TLS certificate issued, letting anyone audit CAs for misissued or rogue certificates. (CT) logging for all newly issued public TLS certificates (DV, OV, EV, QWAC, QWAC PSD2) across all DigiCert brands — opt-out is no longer available.
    • Removes CT logging opt-out options from CertCentral, requiring customers who previously excluded certificates from CT logs to reassess their PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. strategy (private PKI hierarchies remain unaffected).
    • Upgrades Multi-Perspective Issuance Corroboration (MPIC) to require corroboration from at least four remote network locations spanning at least two different Regional Internet Registry (RIR) regions, aligning with CA/Browser Forum Phase 4 requirements.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !All public TLS certificates (DV, OV, EV, EU QWAC, EU QWAC PSD2) across all DigiCert brands will be logged to CT logs starting June 1, 2026, removing the ability to opt out of CT logging for newly issued, reissued, or duplicate public TLS certificates.
    • !The CT logging opt-out options are being removed from CertCentral, meaning any workflow or configuration that relied on keeping public TLS certificates out of CT logs will no longer function for certificates issued on or after June 1, 2026.
25. June 10, 2026 seen Jul 13, 2026 · issue 014

    CertCentral Service Users can now have their first and last names updated via UI or API.

    └──▷ HOW TO FIND IT
    Rename a Service User via the CertCentral console to reflect its operational role or owning team.
    📍In CertCentral, go to Account › Service Users, select a Service User, update the First name and Last name fields under User details, then select Update user.
    • Enables updating a Service User's first and last name in CertCentral or via the Services API, making it easier to identify API key ownership and assign users to teams or roles.

    1 detail in Everything

26. June 16, 2026 seen Jul 13, 2026 · issue 014

    CertCentral adds domain-scoped API keys, expands Manager org validation permissions, and improves Smart Seal accessibility.

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Create a least-privilege API key scoped only to domain management — ideal for automation pipelines that manage domain validation without needing certificate ordering access.
    📍In CertCentral, go to Automation › API Keys › Add API Key. Enter a Description, select the target User, then in the API key restrictions (optional) menu select Domains, and click Add API key.
    • New Domains API key restriction scope lets CertCentral API keys be limited exclusively to domain management actions (add, submit, validate, revalidate domains) with no access to certificate ordering or account management.
    • Expands Manager role permissions to include the full organization prevalidation workflow: access the Organizations page, view all organizations, add organizations, and submit them for validation independently of a certificate request.
    • Improved DigiCert Smart Seal and Site Seal keyboard accessibility: users can now tab to the seal, activate it with Enter or Space, and receive a visible focus ring — giving keyboard-only users the same hover information as mouse users.
    • Smart Seal and Site Seal now meet WCAG 2.1 criteria (SC 1.1.1, SC 2.1.1, SC 4.1.2): descriptive alt text added to PNG and SVG seal variants, seals identified as interactive buttons to assistive technologies, and screen readers receive the label 'Verify DigiCert TLS certificate for this site'.

    4 details in Everything

27. June 30, 2026 seen Jul 13, 2026 · issue 014

    CertCentral Service Users now support custom first and last names for clearer API key identification.

    └──▷ HOW TO FIND IT
    When creating a Service User for a specific integration, set meaningful names so admins can instantly identify the key's purpose in the API Keys list.
    📍In CertCentral, go to Automation › API Keys › Add API Key. In the Add API Key window, select Create new service user from the User menu, then replace the default Service and User values in the First Name and Last Name fields (e.g., First Name: Integration, Last Name: Production). Complete the remaining fields and select Add API Key.
    • Enables custom first and last name assignment when creating a Service User, replacing the generic Service/'User' defaults to reflect team, integration, or role context.

    1 detail in Everything

28. May 12, 2026 seen Jul 13, 2026 · issue 014

    CertCentral adds editable ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. Directory URL limits and automated authorized representative delegation for PKIo certs in Europe.

    ⤢ ⤢
    └──▷ HOW TO FIND IT
    Modify an existing ACME Directory URL's allowed domains and order cap instead of creating a new one — useful when onboarding new subdomains or scaling automation quotas.
    📍In CertCentral, go to Automation › ACME Directory URLs. In the Actions menu for the target URL, select Update ACME Directory URL. Under Allowed SANs (optional), add or remove domains. Under Number of allowed orders (optional), increase the limit or remove it to restore unlimited status. Select Update ACME Directory URL.
    Set up authorized representative delegation for a service user so PKIo Private Services Server certificate orders are auto-approved without repeated manual sign-offs.
    📍In CertCentral Europe, go to Account › Users. Select the target user. Under Authorized representative delegation, select Request authority delegation. In the Submit a delegation request window, choose the organization and authorized representative, then select Submit.
    • Enables editing of domain (SAN) and order limit restrictions on existing ACME Directory URLs — add/remove allowed SANs, adjust order caps, or restore unlimited status without creating a new URL.
    • Introduces automated Authorized Representative Delegation in CertCentral Europe for PKIo Private Services Server certificates, allowing PKIo orders to be auto-approved after a one-time delegate setup — eliminating per-order manual approvals.
    • Supports delegation of authorized representative authority to administrators, managers, and service users, enabling bulk certificate issuance via CertCentral Europe or the Services API.

    3 details in Everything

29. September 15, 2026 seen Jul 13, 2026 · issue 014

    DigiCert CertCentral now issues public TLS certificates with partitioned CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. Distribution Point URLs, capping each CRL at ~9.5 MB.

    • All newly issued public DigiCert TLS certificates include CRLDP URLs pointing to partitioned CRLs (~9.5 MB each) instead of a single monolithic revocation list.

    1 detail in Everything

30. July 7, 2026 Jul 7, 2026 · release notes

    Allowed validity periods now configures certificate validity rather than order validity.

    └──▷ BREAKING ON UPGRADE

    • !The Allowed validity periods setting no longer controls order validity; it now controls certificate validity.
    • !Customized order validity options removed from Annual plan and Multi-year Plan request forms.
31. June 16, 2026 Jun 16, 2026 · release notes

    DigiCert CertCentral adds Domain-restricted API keys, expands Manager permissions for org validation, and improves seal accessibility.

    • Adds new Domains API key restriction option in the Automation > API Keys UI
    • Expands Manager permissions to include the organization prevalidation workflow (access Organizations page, view/add/submit organizations)
    • Improves DigiCert Smart Seal and Site Seal accessibility with WCAG 2.1 compliant keyboard navigation and ARIA labels

    3 details in Everything

32. May 12, 2026 May 12, 2026 · release notes

    CertCentral updates ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. Directory URL restrictions post-creation and adds automated PKIo delegation in Europe

    • Adds the ability to update Allowed SANs and order limits on existing ACME Directory URLs via the UI's Automation > ACME Directory URLs page, eliminating the need to recreate the resource.
    • Enables decreasing the number of allowed orders for an existing ACME Directory URL if the current limit has not been reached.
    • Allows returning an ACME Directory URL to unlimited status by removing the existing order limit via the Update ACME Directory URL restrictions window.
    • Adds automated authorized representative delegation for PKIo Private Services Server certificates in CertCentral Europe, allowing immediate issuance after domain and organization validation are complete.
    • Enables authorized representatives (Administrators, Managers, Service users) to delegate their approval authority to other Users within CertCentral Europe.

    5 details in Everything

33. March 1, 2027 May 1, 2026 · release notes

    DigiCert CertCentral adds new EKU options on cert request forms for Client Authentication support post-March 2027.

    • CertCentral public TLS/SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certificate request forms now include two new Extended Key Usage (EKU) options to retain Client Authentication capability after March 1, 2027.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Public TLS certificates issued on or after March 1, 2027 will no longer include the Client Authentication EKU by default.
34. March 24, 2026 Mar 24, 2026 · release notes

    DigiCert CertCentral adds order_approval_email_sent and order_approval_complete webhook events

    • order_approval_email_sent webhook event fires when the approval email has been sent to all specified recipients.
    • order_approval_complete webhook event fires when a recipient approves the order.

    2 details in Everything

35. March 17, 2026 Mar 17, 2026 · release notes

    Adds Allowed SANs and Number of allowed orders controls to ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. Directory URLs in CertCentral UI

    • Adds Allowed SANs field to ACME Directory URL configuration to restrict which domains can be included in issued certificates
    • Adds Number of allowed orders field to ACME Directory URL configuration to set issuance quotas

    2 details in Everything

36. March 3, 2026 Mar 3, 2026 · release notes

    CertCentral now validates DNSSECDNSSECA set of DNS extensions, maintained by the IETF, that add cryptographic signatures to DNS records so resolvers can verify responses have not been tampered with in transit. for domain control and CAA checks, returning dns_sec_validation_error.

    • Adds dns_sec_validation_error as a new error code in the Services API for certificate requests with reject_if_pending: true when DNSSEC validation fails.

    1 detail in Everything

37. February 24, 2026 Feb 24, 2026 · release notes

    CertCentral retires legacy ACMEACMEAn IETF-standard protocol (RFC 8555) for automating TLS certificate issuance and renewal, letting cyber tools manage certificates without manual CA interaction. service and enforces stricter certificate validity periods per CA/Browser Forum ballots.

    • Adds warning icon to identify legacy ACME credentials in the CertCentral UI on the Automation > ACME Directory URLs page
    • Retires the legacy CertCentral ACME service, requiring new credential creation for automation workflows
    • Enforces 199-day maximum validity for public TLS certificates issued on or after February 24, 2026
    • Shortens domain validation reuse period to 199 days for all existing and new validations
    • Shortens organization validation reuse period for public OV TLS certificates to 397 days

    +2 more show less

    • Enforces 459-day maximum validity for public code signing certificates issued on or after February 24, 2026
    • Validates DNSSECDNSSECA set of DNS extensions, maintained by the IETF, that add cryptographic signatures to DNS records so resolvers can verify responses have not been tampered with in transit. during domain control verification and CAA checks

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Requests to legacy ACME URLs will fail to issue a certificate starting February 24, 2026
    • !All public TLS certificates issued on or after February 24, 2026 can't exceed the new 199-day maximum validity
    • !All public code signing certificates issued on or after February 24, 2026 can't exceed the new 459-day maximum validity
38. January 15, 2026 Jan 15, 2026 · release notes

    Automated authorized representative approval delegation for QWAC and QWAC PSD2 certificates in CertCentral Europe via API and UI.

    • Adds automated approval delegation workflow for QWAC and QWAC PSD2 orders, allowing an authorized representative to delegate authority to Administrators, Managers, or Service Users.
    • Adds Request authority delegation action in the CertCentral Europe UI under Account > Users > [User Details] > Authorized representative delegation.

    2 details in Everything

39. January 13, 2026 Jan 13, 2026 · release notes

    CertCentral adds Validation expires SC-081 column/field and Download Filtered Records for domain/OV validation reuse dates

    • Adds Validation expires SC-081 column to the Domains page for comparing original vs. new domain expiration dates.
    • Adds Validation expires SC-081 field to domain detail pages for viewing shortened domain revalidation timelines.
    • Adds Download Filtered Records option under Domains for exporting filtered domains (limit 1,000 records).
    • Adds second OV organization expiration date (Expires on {{date}} per SC-081) to organization detail pages.

    4 details in Everything