https://cybertoolchain.io/tools/digicert-certcentral New releases and features in DigiCert CertCentral, tracked by The Cyber Toolchain. en Fri, 30 Oct 2026 07:46:52 GMT https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html Fri, 30 Oct 2026 07:46:52 GMT DigiCert CertCentral: Check supported ICA chains per product via the Product info API's `allowed_ca_certs` field; if absent, ICA selection is not enabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • When ordering through the CertCentral Europe Services API (`https://certcentral.digicert.eu/services/v2`), omitting the optional `ca_cert_id` parameter on a product set to the DigiCert default ICA chain triggers automatic key-type matching between the ICA chain and the CSR. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral-europe--ica-chain-key-type-matching-for-products-with-ica-selection-enabled-619426 https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral-europe--ica-chain-key-type-matching-for-products-with-ica-selection-enabled-619426 Tue, 27 Oct 2026 00:00:00 GMT CertCentral Europe now auto-matches ICA chain key type to CSR key type, with warnings on mismatches for products with ICA selection enabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • CertCentral Europe automatically selects an ICA chain whose key type matches the CSR key type when a product's default ICA chain is set to 'DigiCert default', for products with ICA selection enabled that support both RSA and ECC.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • CertCentral Europe shows a key-type mismatch warning on the request form when a specific ICA chain is selected whose key type differs from the CSR key type, while still allowing order submission with a mixed chain (e.g. ECC certificate with RSA ICA chain). • The `Intermediate chains [Intermediate CA] > [Root CA]` menu on the request form lets practitioners select a matching ICA chain or proceed with a mixed chain when a mismatch warning appears. • Administrators can verify ICA selection status and default chain per product via `Settings > Product Settings` and the `Allowed intermediate chains` and `Default intermediate chain` menus in CertCentral Europe. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html Tue, 20 Oct 2026 07:54:57 GMT CertCentral adds a 'DigiCert default (recommended)' option to the Default intermediate chain menu and cleans up Apache download bundles ahead of G5 migration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds DigiCert default (recommended) option to the `Default intermediate chain` product menu so operators can distinguish a DigiCert-chosen chain from one they explicitly selected; the `ca_cert_id` API parameter continues to override this setting per-request.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Apache download (`DigiCertCA.crt`) for G5 and G2 TLS certificates will no longer include the unneeded self-signed root — only the cross-signed root remains, removing the need for manual post-download cleanup scripts. • The `disable_ct` parameter on certificate order requests (including `Order Basic OV`) is deprecated; CertCentral now ignores it and always logs issued TLS certificates to CT logs regardless of the value passed. Breaking changes: • Scripts that remove a certificate by position in the Apache `DigiCertCA.crt` file, or that expect a specific number of certificates in the file, will break after October 20, 2026 — update scripts to remove the self-signed root only if present and always retain the cross-signed root. • The `disable_ct` parameter is ignored as of this change: requests that set `disable_ct` to `true` to suppress CT logging will no longer have that effect — certificates will be logged to CT logs unconditionally. • Starting November 12, 2026, new browser-trusted TLS orders, renewals, reissues, and duplicates will default to G5 root hierarchies; accounts relying on Global G2 or G3 intermediate chains must explicitly select those chains via the `Default intermediate chain` menu or the `ca_cert_id` API parameter before that date. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral--tls-certificate-issuance-moves-to-g5-rsa-and-ecc-roots-by-default-619426 https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral--tls-certificate-issuance-moves-to-g5-rsa-and-ecc-roots-by-default-619426 Thu, 15 Oct 2026 00:00:00 GMT DigiCert CertCentral now enforces DCV method settings on API requests, returning structured errors for disallowed methods⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • API requests that include a DCV method not enabled in your account now return `invalid_value` (on order or add-domain requests) or `dcv_method_not_allowed` (on DCV method changes) instead of silently succeeding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • CertCentral's 'DCV methods' setting under Settings > Preferences > Advanced Settings > Domain Control Validation now governs which values are accepted in the `dcv_method` parameter across all affected Services API endpoints — order endpoints, 'Change DCV method' (pending orders), 'Add domain', and 'Change DCV method' (domain validation). • DigiCert CertCentral now issues all browser-trusted TLS certificates (DV, OV, and EV) from the G5 root hierarchies — `DigiCert TLS RSA4096 Root G5` and `DigiCert TLS ECC P384 Root G5` — by default across DigiCert, GeoTrust, Thawte, RapidSSL, and Encryption Everywhere brands. Breaking changes: • API requests that pass a `dcv_method` value not enabled in the account's DCV methods configuration now receive an `invalid_value` or `dcv_method_not_allowed` error rather than being accepted; any Services API integration using a DCV method that is not selected in Settings > Preferences > Advanced Settings > Domain Control Validation will break. • All new TLS certificate orders, renewals, reissues, and duplicates are now issued from `DigiCert TLS RSA4096 Root G5` or `DigiCert TLS ECC P384 Root G5`; trust stores, hard-coded root or intermediate CA certificate trust, and pinned certificates that do not include the G5 roots and intermediates will cause service disruptions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral--apache-certificate-download-will-no-longer-include-unneeded-self-signed-g5-and-g2-roots-619426 https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral--apache-certificate-download-will-no-longer-include-unneeded-self-signed-g5-and-g2-roots-619426 Thu, 15 Oct 2026 00:00:00 GMT CertCentral Apache download drops unneeded self-signed G5/G2 roots; Default intermediate chain menu gains a 'DigiCert default (recommended)' option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • The `Default intermediate chain` menu in `Settings > Product Settings` now shows a DigiCert default (recommended) option so you can distinguish DigiCert's default chain from a chain you explicitly selected.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Apache `.crt` download files for G5 and G2 TLS certificates will contain only the intermediate CA and cross-signed root — the self-signed G5 and G2 roots are removed from `DigiCertCA.crt`. Breaking changes: • As of October 20, 2026, the Apache `DigiCertCA.crt` file for G5 and G2 TLS certificates drops from three certificates to two (intermediate CA and cross-signed root only). Scripts that remove a certificate by position or that expect a specific certificate count will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://knowledge.digicert.com/alerts/digicert-root-strategy-aligning-with-industry-standards#DC-transitioning https://knowledge.digicert.com/alerts/digicert-root-strategy-aligning-with-industry-standards#DC-transitioning Thu, 15 Oct 2026 00:00:00 GMT DigiCert transitions all browser-trusted TLS certificate issuance to G5 root hierarchies (RSA4096 and ECC P384) on November 12, 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Switches default TLS certificate issuance — new orders, renewals, reissues, and duplicates — to `DigiCert TLS RSA4096 Root G5` and `DigiCert TLS ECC P384 Root G5` root hierarchies across all DigiCert, GeoTrust, Thawte, RapidSSL, and Encryption Everywhere brands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Applies to all browser-trusted DV, OV, and EV TLS certificates for all public TLS customers; certificate chains may include server, intermediate CA, and cross-signed root certificates. • Customers managing custom trust stores must add and trust the G5 root and intermediate CA certificates to maintain service continuity. Breaking changes: • All newly issued, renewed, reissued, and duplicate TLS certificates will chain to `DigiCert TLS RSA4096 Root G5` or `DigiCert TLS ECC P384 Root G5` starting November 12, 2026 — any trust store, pinned root, or hard-coded intermediate CA certificate that does not include the G5 roots and ICAs will fail validation and cause service disruptions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral--tls-certificate-issuance-moves-to-g5-rsa-and-ecc-roots-by-default-619426 https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral--tls-certificate-issuance-moves-to-g5-rsa-and-ecc-roots-by-default-619426 Thu, 08 Oct 2026 00:05:29 GMT CertCentral defaults to G5 RSA/ECC roots for all TLS issuance and trims self-signed roots from Apache downloads.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Switches default TLS certificate issuance (new orders, renewals, reissues, and duplicates) to `DigiCert TLS RSA4096 Root G5` and `DigiCert TLS ECC P384 Root G5` for all DV, OV, and EV certificates across DigiCert, GeoTrust, Thawte, RapidSSL, and Encryption Everywhere brands.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Breaking changes: • Scripts or automation that remove the extra self-signed root from the Apache download file, or that expect a specific number of certificates in `DigiCertCA.crt`, will break after October 15, 2026: the file now contains two certificates (intermediate CA and cross-signed root) instead of three. • Trust stores that do not already include `DigiCert TLS RSA4096 Root G5` and `DigiCert TLS ECC P384 Root G5` must add and trust those roots, or newly issued certificates will fail validation. • Hard-coded or pinned root/intermediate CA certificate trust will break as issuance moves to G5 hierarchies — policies requiring hard-coding or pinning must be removed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html Sat, 26 Sep 2026 07:48:34 GMT DigiCert CertCentral: Adds Persistent DNS TXT automatic domain revalidation: CertCentral revalidates domains via the Persistent DNS TXT DCV method every five days, eliminating the need to manually resubmit domains before the nine-day revalidation window expires.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Breaking changes: • All new TLS certificate orders, renewals, reissues, and duplicates will be issued from `DigiCert TLS RSA4096 Root G5` or `DigiCert TLS ECC P384 Root G5` by default as of October 15, 2026 — customers managing trust stores, hard-coding CA certificate trust, or pinning root/intermediate CA certificates must update their configurations or face service disruptions. • MPIC enforcement as of December 1, 2026 requires that DNS queries and website traffic be reachable from six remote network perspectives across at least two RIR regions — environments that restrict traffic by IP address, region, query volume, or rate may block validation and must be reconfigured. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html Fri, 25 Sep 2026 07:51:34 GMT Breaking changes: • TLS certificate issuance now defaults to the G5 root hierarchies (`DigiCert TLS RSA4096 Root G5` and `DigiCert TLS ECC P384 Root G5`); customers managing trust stores, hard-coding root or intermediate CA certificate trust, or pinning root or intermediate CA certificates must update their configurations or face service disruptions. • MPIC now requires six remote network perspectives and four corroborations per domain query; customers restricting DNS queries or website traffic by IP address, region, query volume, or rate must verify their configurations support MPIC traffic from six remote perspectives. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html Thu, 24 Sep 2026 07:52:12 GMT CertCentral adds Persistent DNS TXT automatic domain revalidation and shifts TLS issuance to G5 RSA/ECC roots by default⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Shifts default TLS certificate issuance (new orders, renewals, reissues, and duplicates) to `DigiCert TLS RSA4096 Root G5` and `DigiCert TLS ECC P384 Root G5` hierarchies for all DV, OV, and EV certificates across DigiCert, GeoTrust, Thawte, RapidSSL, and Encryption Everywhere brands. • Enforces six remote MPIC network perspectives across at least two RIR regions for domain control verification and CAA checks, requiring four corroborations per domain query, in compliance with the CA/Browser Forum MPIC requirements effective December 15, 2026. Breaking changes: • TLS certificates (new orders, renewals, reissues, duplicates) will be issued from `DigiCert TLS RSA4096 Root G5` and `DigiCert TLS ECC P384 Root G5` by default as of October 15, 2026 — customers who hard-code or pin root/intermediate CA certificates, or manage their own trust stores, must add and trust the G5 root and intermediate CA certificates or face service disruptions. • MPIC enforcement as of December 1, 2026 increases to six remote network perspectives requiring four corroborations — environments that restrict DNS queries or website traffic by IP address, region, query volume, or rate must verify their configurations support MPIC traffic from six remote perspectives or certificate issuance may fail. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/certcentral/perform-domain-control-validation--dcv-/validate-domains-before-or-during-certificate-orders/validate-domains-using-dns-validation-methods/add-and-validate-a-domain-using-persistent-dns-txt-record.html#enable-the-persistent-dns-txt-record-dcv-method https://docs.digicert.com/en/certcentral/perform-domain-control-validation--dcv-/validate-domains-before-or-during-certificate-orders/validate-domains-using-dns-validation-methods/add-and-validate-a-domain-using-persistent-dns-txt-record.html#enable-the-persistent-dns-txt-record-dcv-method Tue, 22 Sep 2026 00:00:00 GMT CertCentral now auto-revalidates domains via Persistent DNS TXT Record DCV every five days, preventing expired validations from blocking certificate issuance.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds automatic domain revalidation using the Persistent DNS TXT Record DCV method, where DigiCert checks and revalidates domains every five days as long as the Persistent DNS TXT record with the correct persistent URI value (Account or Unique) remains in place.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports automatic revalidation for OV and EV TLS, Qualified Website Authentication Certificates (QWAC), QWAC PSD2, PKIo Private Services Server, and X9 PKI for TLS certificate types — with validated domains added to the Domains page where revalidation runs. • Persistent DNS TXT domain validation is reusable for nine days before revalidation is required, with the automatic process eliminating the need to manually resubmit domains before expiry. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html Mon, 31 Aug 2026 07:40:41 GMT CertCentral adds configurable default Key Usage setting for X9 PKI for TLS certificate request forms. • Adds a configurable 'Default Key Usage' setting on the X9 PKI for TLS Product Settings page, letting CertCentral Administrators choose whether 'Digital signature' or 'Digital signature and key encipherment' is pre-selected on the X9 PKI for TLS certificate request form. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html Sun, 23 Aug 2026 09:03:16 GMT CertCentral adds Persistent DNS TXT record bulk revalidation, X9 PKI multi-year TLS certs, and in-place ACME ICA updates • Adds support for the Persistent DNS TXT record DCV method in CertCentral bulk domain revalidation — a one-time DNS TXT record containing a DigiCert-provided persistent URI that is reused on every subsequent revalidation without creating new records or values. • Extends X9 PKI for TLS certificate validity options from 397-day maximum to selectable 1-, 2-, or 3-year terms (custom validity capped at 1,095 days), available on the Dashboard under Request a Certificate > Request X9 PKI for TLS Certificate > Certificate Settings > Validity period. • Enables updating the issuing intermediate CA (ICA) certificate on an existing ACME Directory URL without creating a new URL — accessible via the ACME Directory URL Restrictions panel using the 'Intermediate chains [Intermediate CA] > [Root CA]' menu. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral--bulk-domain-revalidation-support-for-the-persistent-dns-txt-record-method-619426 https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral--bulk-domain-revalidation-support-for-the-persistent-dns-txt-record-method-619426 Tue, 18 Aug 2026 00:00:00 GMT CertCentral adds Persistent DNS TXT record bulk revalidation, 2- and 3-year X9 PKI for TLS validity, and in-place ACME Directory URL ICA updates. • Adds 'Revalidation by Persistent DNS TXT record' option to the bulk domain revalidation workflow under Certificates > Domains, allowing a one-time DNS TXT record containing a DigiCert-provided persistent URI to be reused for every subsequent domain revalidation — no new record or URI value required each cycle. • Extends X9 PKI for TLS certificate validity options from a maximum of 397 days to selectable 1-, 2-, or 3-year terms (custom validity capped at 1,095 days), available in the Validity period section of the Request X9 PKI for TLS Certificate page. • Enables updating the issuing intermediate CA (ICA) certificate on an existing ACME Directory URL via Automation > ACME Directory URLs > Actions > 'Update ACME Directory URL', replacing the previous requirement to create a new ACME Directory URL to change the certificate chain. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html Sat, 15 Aug 2026 09:05:12 GMT CertCentral adds CSR-driven CN/SANs repopulation, DCV polling status fields, and Service User name editing. • Adds `dcv_polling_status` and `dcv_polling_last_checked` fields to the Services API responses for certificate requests and DNS name validations, surfacing whether DigiCert's automatic DCV polling is active and when it last ran. • Adds a 'Use CN/SANs from CSR' option on certificate request forms (DV, OV, EV TLS; QWAC and QWAC PSD2; X9 PKI for TLS; Private TLS) to replace existing Common Name and SANs fields with values from the uploaded CSR, with an 'Undo' option to revert. • Enables updating a Service User's first and last names in CertCentral, making it easier to distinguish Service Users and assign them to teams or operational roles. • Simplifies the delegation request workflow by removing the organization selection step — a single delegation request now applies to all organizations the selected approver represents and all certificate products they are authorized to approve. • Removes CT logging 'opt out' options from CertCentral, enforcing CT logging on all public TLS certificates (DV, OV, EV, QWAC, QWAC PSD2) across all DigiCert brands. • Begins DNSSEC validation during domain control validation and DNS CAA checks, returning DNSSEC-specific error and status messages in CertCentral order details pages and via the Services API when issues are detected. • Updates Multi-Perspective Issuance Corroboration (MPIC) to require corroboration from at least four remote network locations across at least two different Regional Internet Registry regions. • Transitions TLS certificate issuance to DigiCert's X9 PKI hierarchies. • Retires the legacy CertCentral ACME service, with legacy ACME credential warnings shown in the ACME credentials table and requests to legacy ACME URLs failing to issue certificates after the retirement date. • Moves public TLS certificate maximum validity to 199 days and public code signing certificate maximum validity to 459 days, per CA/Browser Forum requirements. • Reduces domain validation and organization validation reuse periods to one day less than the CA/Browser Forum permitted maximums. • Announces retirement of CertCentral Discovery and Managed Automation services on October 1, 2026, with capabilities moving to DigiCert Trust Lifecycle Manager. Breaking changes: • Public TLS certificates will no longer be issued with the Client Authentication EKU; existing workflows that depend on this EKU on newly issued certificates will break. • CT logging opt-out options are removed from CertCentral — certificates that previously needed to be kept out of CT logs can no longer be issued that way from June 1, 2026 onward. • Requests to legacy ACME URLs will fail to issue a certificate after the legacy CertCentral ACME service retirement date; legacy credentials must be replaced with new CertCentral ACME credentials. • CertCentral Discovery and Managed Automation services retire on October 1, 2026 — integrations relying on these services will stop working. • TLS certificate validity is capped at 199 days and code signing certificate validity at 459 days; orders requesting longer validity periods will be rejected or truncated. • DNSSEC validation is now enforced during DCV and CAA checks — domains with misconfigured DNSSEC will block certificate issuance until the configuration is resolved. • MPIC now requires corroboration from at least four remote network locations across at least two RIR regions — certificate issuance fails if more than one perspective does not corroborate. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#august-11--2026 https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#august-11--2026 Tue, 11 Aug 2026 00:00:00 GMT CertCentral adds 'Use CN/SANs from CSR' option to replace Common name and SANs on certificate request forms • Adds 'Use CN/SANs from CSR' option on certificate request forms to overwrite existing Common name and SANs fields with values parsed directly from the uploaded CSR, with an 'Undo' option to restore previous values — available on DV, OV, and EV TLS; QWAC and QWAC PSD2; X9 PKI for TLS; and Private TLS request forms. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html Fri, 31 Jul 2026 16:20:14 GMT CertCentral adds DCV polling status to APIs, ACME URL delegation/transfer, API key transfer, and broader automated delegation approvals. • Enables Administrators to transfer API key ownership to another CertCentral user or Service User, keeping transferred keys valid until revoked or deactivated. • Simplifies delegation request workflow by removing the organization selection step — a single delegation request now applies to all organizations the approver represents across all authorized certificate products. • Extends automated delegation approval support in CertCentral Europe to a broader set of PKIo and EU Qualified certificate products. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/certcentral/order-and-manage-certificates/authorized-representative-approval-delegation.html https://docs.digicert.com/en/certcentral/order-and-manage-certificates/authorized-representative-approval-delegation.html Wed, 29 Jul 2026 00:00:00 GMT CertCentral automated delegation approval expands to EV TLS, EV Code Signing, Verified Mark, and PKIo products globally and in Europe. • Extends automated delegation approval to EV TLS, EV Code Signing, Code Signing, Verified Mark, and Common Mark certificates in CertCentral global and Europe. • Adds automated delegation approval support for a broad set of CertCentral Europe products including EU Qualified eSeal (PSD2), EU Qualified Website Authentication Certificate (PSD2), PKIo Personal Organisation, PKIo Qualified eSeal, PKIo Private Person, and multiple PKIo Authentication/Encryption and Private Services Server variants. • Simplifies the delegation request workflow: a single request now covers all organizations the selected approver represents and all certificate products they are authorized to approve, removing the previous per-organization selection step. • Enables fully automated certificate issuance via CertCentral UI and Services API once a delegated approver is assigned, eliminating repeated manual approvals per order. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral-services-api--dcv-polling-status-added-to-domain-info-and-order-validation-status-responses-619426 https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral-services-api--dcv-polling-status-added-to-domain-info-and-order-validation-status-responses-619426 Tue, 28 Jul 2026 00:00:00 GMT CertCentral adds DCV polling status to APIs, ACME URL delegation to Service Users, and API key ownership transfers. • Adds `dcv_polling_status` and `dcv_polling_last_checked` fields to the Domain info and Order validation status API endpoints, exposing whether automatic DCV polling is active and when it last ran. • Enables creating ACME Directory URLs on behalf of another CertCentral user, Service User, or new Service User — no longer limited to self-service only. • Enables transferring ACME Directory URL ownership to another CertCentral user or Service User, decoupling credentials from individual accounts. • Enables transferring API key ownership to another CertCentral user or Service User, allowing integrations to survive user departures without credential rotation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/certcentral/perform-domain-control-validation--dcv-/validate-domains-before-or-during-certificate-orders/validate-domains-using-dns-validation-methods/add-and-validate-a-domain-using-persistent-dns-txt-record.html https://docs.digicert.com/en/certcentral/perform-domain-control-validation--dcv-/validate-domains-before-or-during-certificate-orders/validate-domains-using-dns-validation-methods/add-and-validate-a-domain-using-persistent-dns-txt-record.html Wed, 15 Jul 2026 01:23:02 GMT CertCentral adds Persistent DNS TXT Record DCV, enabling one-time DNS setup for repeated domain revalidations. • Adds Persistent DNS TXT Record as a new domain control validation (DCV) method, allowing a single DNS TXT record to satisfy repeated revalidations without creating new records each cycle. • Supports an Account URI option — one shared persistent URI to validate any domain across the entire CertCentral account, simplifying multi-domain DNS management. • Supports a Unique URI option — a domain-specific persistent URI to avoid publicly linking domains through shared DNS records. • Enables Persistent DNS TXT Record DCV on certificate request forms, the Domains page (add/validate/revalidate), and pending OV, EV, and DV TLS certificate orders once activated in account preferences. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral-tls-product-settings--custom-validity-now-applies-to-certificate-validity--not-order-validity-619426 https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral-tls-product-settings--custom-validity-now-applies-to-certificate-validity--not-order-validity-619426 Mon, 13 Jul 2026 10:07:04 GMT CertCentral's Allowed validity periods setting now controls certificate validity (max 199 days), not order validity, with updated TLS request forms. • Allowed validity periods setting for TLS products now controls certificate validity instead of order validity, capped at the 199-day maximum. • Annual plan and Multi-year Plan TLS request forms now show coverage options in years (1-, 2-, 3-year) with custom order validity options removed. • For non-Annual/non-Multi-year Plan TLS requests, certificate validity and order validity are now unified (e.g., a 47-day cert creates a 47-day order). • Breaking change: any previously configured allowed validity periods exceeding 199 days are automatically removed from TLS product settings. Breaking changes: • The `Allowed validity periods` setting in TLS certificate product settings no longer controls order validity; it now controls certificate validity. Any previously configured validity periods greater than 199 days will be automatically removed from the setting. • Customized order validity options have been removed from Annual plan and Multi-year Plan TLS certificate request forms; coverage options now appear only in years (1-, 2-, or 3-year). • For non-Annual plan and non-Multi-year Plan TLS certificate requests, any validity periods greater than 199 days have been removed, and certificate validity now determines order validity. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral--all-public-tls-certificates-must-be-logged-to-ct-logs-619426 https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral--all-public-tls-certificates-must-be-logged-to-ct-logs-619426 Mon, 13 Jul 2026 10:07:04 GMT CertCentral enforces CT logging for all public TLS certs and upgrades MPIC to four remote locations across two RIRs. • Enforces Certificate Transparency (CT) logging for all newly issued public TLS certificates (DV, OV, EV, QWAC, QWAC PSD2) across all DigiCert brands — opt-out is no longer available. • Removes CT logging opt-out options from CertCentral, requiring customers who previously excluded certificates from CT logs to reassess their PKI strategy (private PKI hierarchies remain unaffected). • Upgrades Multi-Perspective Issuance Corroboration (MPIC) to require corroboration from at least four remote network locations spanning at least two different Regional Internet Registry (RIR) regions, aligning with CA/Browser Forum Phase 4 requirements. Breaking changes: • All public TLS certificates (DV, OV, EV, EU QWAC, EU QWAC PSD2) across all DigiCert brands will be logged to CT logs starting June 1, 2026, removing the ability to opt out of CT logging for newly issued, reissued, or duplicate public TLS certificates. • The CT logging opt-out options are being removed from CertCentral, meaning any workflow or configuration that relied on keeping public TLS certificates out of CT logs will no longer function for certificates issued on or after June 1, 2026. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://dev.digicert.com/en/certcentral-apis/services-api/users/edit-service-user.html https://dev.digicert.com/en/certcentral-apis/services-api/users/edit-service-user.html Mon, 13 Jul 2026 10:07:04 GMT CertCentral Service Users can now have their first and last names updated via UI or API. • Enables updating a Service User's first and last name in CertCentral or via the Services API, making it easier to identify API key ownership and assign users to teams or roles. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral--expanded-manager-permissions-for-organization-validation-619426 https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral--expanded-manager-permissions-for-organization-validation-619426 Mon, 13 Jul 2026 10:07:04 GMT CertCentral adds domain-scoped API keys, expands Manager org validation permissions, and improves Smart Seal accessibility. • New 'Domains' API key restriction scope lets CertCentral API keys be limited exclusively to domain management actions (add, submit, validate, revalidate domains) with no access to certificate ordering or account management. • Expands Manager role permissions to include the full organization prevalidation workflow: access the Organizations page, view all organizations, add organizations, and submit them for validation independently of a certificate request. • Improved DigiCert Smart Seal and Site Seal keyboard accessibility: users can now tab to the seal, activate it with Enter or Space, and receive a visible focus ring — giving keyboard-only users the same hover information as mouse users. • Smart Seal and Site Seal now meet WCAG 2.1 criteria (SC 1.1.1, SC 2.1.1, SC 4.1.2): descriptive alt text added to PNG and SVG seal variants, seals identified as interactive buttons to assistive technologies, and screen readers receive the label 'Verify DigiCert TLS certificate for this site'. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/certcentral/manage-users-and-access/add-users-to-your-account/service-users.html https://docs.digicert.com/en/certcentral/manage-users-and-access/add-users-to-your-account/service-users.html Mon, 13 Jul 2026 10:07:04 GMT CertCentral Service Users now support custom first and last names for clearer API key identification. • Enables custom first and last name assignment when creating a Service User, replacing the generic 'Service'/'User' defaults to reflect team, integration, or role context. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral-acme-directory-urls--update-domain-and-order-limit-restrictions-619426 https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral-acme-directory-urls--update-domain-and-order-limit-restrictions-619426 Mon, 13 Jul 2026 10:07:04 GMT CertCentral adds editable ACME Directory URL limits and automated authorized representative delegation for PKIo certs in Europe. • Enables editing of domain (SAN) and order limit restrictions on existing ACME Directory URLs — add/remove allowed SANs, adjust order caps, or restore unlimited status without creating a new URL. • Introduces automated Authorized Representative Delegation in CertCentral Europe for PKIo Private Services Server certificates, allowing PKIo orders to be auto-approved after a one-time delegate setup — eliminating per-order manual approvals. • Supports delegation of authorized representative authority to administrators, managers, and service users, enabling bulk certificate issuance via CertCentral Europe or the Services API. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://knowledge.digicert.com/alerts/crl-partitioning-for-public-tls-certificates-issued-from-digicert-ica-certificates https://knowledge.digicert.com/alerts/crl-partitioning-for-public-tls-certificates-issued-from-digicert-ica-certificates Mon, 13 Jul 2026 10:07:04 GMT DigiCert CertCentral now issues public TLS certificates with partitioned CRL Distribution Point URLs, capping each CRL at ~9.5 MB. • All newly issued public DigiCert TLS certificates include CRLDP URLs pointing to partitioned CRLs (~9.5 MB each) instead of a single monolithic revocation list. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral--expanded-manager-permissions-for-organization-validation-619426 https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#certcentral--expanded-manager-permissions-for-organization-validation-619426 Tue, 16 Jun 2026 00:00:00 GMT DigiCert CertCentral adds Domain-restricted API keys, expands Manager permissions for org validation, and improves seal accessibility. • Adds new `Domains` API key restriction option in the Automation > API Keys UI • Expands Manager permissions to include the organization prevalidation workflow (access Organizations page, view/add/submit organizations) • Improves DigiCert Smart Seal and Site Seal accessibility with WCAG 2.1 compliant keyboard navigation and ARIA labels Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://googlechrome.github.io/chromerootprogram/#132-promote-use-of-dedicated-tls-server-authentication-pki-hierarchies https://googlechrome.github.io/chromerootprogram/#132-promote-use-of-dedicated-tls-server-authentication-pki-hierarchies Fri, 01 May 2026 00:00:00 GMT DigiCert CertCentral adds new EKU options on cert request forms for Client Authentication support post-March 2027. • `CertCentral` public TLS/SSL certificate request forms now include two new Extended Key Usage (EKU) options to retain Client Authentication capability after March 1, 2027. Breaking changes: • Public TLS certificates issued on or after March 1, 2027 will no longer include the Client Authentication EKU by default. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#validating-dnssec-when-verifying-domain-control-and-performing-caa-checks-619426 https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#validating-dnssec-when-verifying-domain-control-and-performing-caa-checks-619426 Tue, 03 Mar 2026 00:00:00 GMT CertCentral now validates DNSSEC for domain control and CAA checks, returning `dns_sec_validation_error`. • Adds `dns_sec_validation_error` as a new error code in the Services API for certificate requests with `reject_if_pending: true` when DNSSEC validation fails. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#moving-to-199-day-validity-for-public-tls-certificates-619426 https://docs.digicert.com/en/whats-new/change-log/certcentral-change-log.html#moving-to-199-day-validity-for-public-tls-certificates-619426 Tue, 24 Feb 2026 00:00:00 GMT CertCentral retires legacy ACME service and enforces stricter certificate validity periods per CA/Browser Forum ballots. • Adds warning icon to identify legacy ACME credentials in the CertCentral UI on the Automation > ACME Directory URLs page • Retires the legacy CertCentral ACME service, requiring new credential creation for automation workflows • Enforces 199-day maximum validity for public TLS certificates issued on or after February 24, 2026 • Shortens domain validation reuse period to 199 days for all existing and new validations • Shortens organization validation reuse period for public OV TLS certificates to 397 days • Enforces 459-day maximum validity for public code signing certificates issued on or after February 24, 2026 • Validates DNSSEC during domain control verification and CAA checks Breaking changes: • Requests to legacy ACME URLs will fail to issue a certificate starting February 24, 2026 • All public TLS certificates issued on or after February 24, 2026 can't exceed the new 199-day maximum validity • All public code signing certificates issued on or after February 24, 2026 can't exceed the new 459-day maximum validity Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral https://docs.digicert.com/en/certcentral/order-and-manage-certificates/authorized-representative-approval-delegation.html https://docs.digicert.com/en/certcentral/order-and-manage-certificates/authorized-representative-approval-delegation.html Thu, 15 Jan 2026 00:00:00 GMT Automated authorized representative approval delegation for QWAC and QWAC PSD2 certificates in CertCentral Europe via API and UI. • Adds automated approval delegation workflow for QWAC and QWAC PSD2 orders, allowing an authorized representative to delegate authority to Administrators, Managers, or Service Users. • Adds `Request authority delegation` action in the CertCentral Europe UI under Account > Users > [User Details] > Authorized representative delegation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/digicert-certcentral