Digicert

---
name: digicert
description: "Expert agent for DigiCert CertCentral and Trust Lifecycle Manager. Covers OV/EV/DV certificate ordering, auto-renewal, DigiCert ONE platform, Trust Lifecycle Manager (vendor-agnostic CLM), CT log monitoring, ACME support, and API automation. WHEN: \"DigiCert\", \"CertCentral\", \"Trust Lifecycle Manager\", \"DigiCert ONE\", \"DigiCert ACME\", \"OV certificate\", \"EV certificate\", \"code signing\", \"DigiCert API\", \"certificate discovery DigiCert\"."
license: MIT
---

# DigiCert

This skill covers DigiCert's certificate management platform. It has deep knowledge of CertCentral, Trust Lifecycle Manager (TLM), DigiCert ONE, certificate types, validation processes, and automation.

## How to Approach Tasks

1. **Identify the platform**: CertCentral (standard cert ordering/management) vs. Trust Lifecycle Manager (enterprise CLM, vendor-agnostic).
2. **Identify certificate type**: DV (domain validation), OV (organization validation), EV (extended validation), code signing, client certificate, S/MIME.
3. **Classify the request**: Ordering, renewal, automation, discovery, compliance, or API integration.

## DigiCert Product Overview

### CertCentral

DigiCert's primary portal for ordering and managing publicly-trusted certificates:
- DV, OV, EV TLS certificates (single-domain, multi-SAN, wildcard)
- Code signing certificates (OV, EV)
- Document signing (DocuSign integration)
- Client certificates (personal authentication)
- Unified Communications (UCC) / SAN certificates for Exchange

### Trust Lifecycle Manager (TLM)

Enterprise-grade CLM (Certificate Lifecycle Management) platform:
- **Vendor-agnostic**: Manage certificates from DigiCert AND other CAs (Let's Encrypt, Entrust, Sectigo, internal AD CS)
- Discovery across network, cloud, and code repositories
- Policy enforcement
- Automation workflows
- Reporting and compliance dashboards
- Supersedes DigiCert CertCentral Manager for enterprise customers

### DigiCert ONE

Unified platform umbrella containing:
- Trust Lifecycle Manager
- Software Trust Manager (code signing)
- IoT Trust Manager (device certificates)
- Document Trust Manager

---

## Certificate Types

### TLS/SSL Certificates

| Type | Validation Level | Validation Time | SAN/Wildcard | Use Case |
|---|---|---|---|---|
| DV SSL | Domain only (email/DNS/file) | Minutes | Multi-SAN, wildcard OK | Internal tools, personal sites |
| OV SSL | Domain + org verification | 1-3 days | Multi-SAN, wildcard OK | Business websites, APIs |
| EV SSL | Domain + org + extended vetting | 3-7 days | Multi-SAN only (no wildcard) | Banking, e-commerce |
| Wildcard OV | Domain + org | 1-3 days | Wildcard only | Subdomains |

**EV certificate limitations**: EV certificates cannot be wildcards (CA/Browser Forum rule). Each SAN must be individually validated.

**Current CA/Browser Forum rules**:
- Maximum validity: 398 days (enforced)
- CN deprecated; use SAN
- SHA-256 minimum
- 2048-bit RSA or P-256 ECDSA minimum

### Code Signing Certificates

| Type | Use Case | HSM Required? |
|---|---|---|
| OV Code Signing | Standard software signing | No (software key) |
| EV Code Signing | Immediate SmartScreen reputation | Yes (hardware token or cloud HSM required) |
| DigiCert Secure Software | Enterprise code signing via DigiCert KeyLocker (HSM) | Yes (DigiCert-managed HSM) |

**EV Code Signing**: Required for kernel-mode drivers on Windows. Provides immediate SmartScreen bypass (OV requires history for SmartScreen trust). As of June 2023, CA/Browser Forum requires hardware-based key storage (HSM or physical USB token) for OV code signing as well.

---

## CertCentral API

### Authentication

```bash
# API Key authentication
curl -X GET https://www.digicert.com/services/v2/user/me \
    -H "X-DC-DEVKEY: <your-api-key>" \
    -H "Content-Type: application/json"
```

### Order a Certificate

```bash
# Order an OV Multi-SAN certificate
curl -X POST https://www.digicert.com/services/v2/order/certificate/ssl_multi_domain \
    -H "X-DC-DEVKEY: <api-key>" \
    -H "Content-Type: application/json" \
    -d '{
        "certificate": {
            "common_name": "example.com",
            "dns_names": ["www.example.com", "api.example.com"],
            "csr": "<base64-encoded-CSR>",
            "signature_hash": "sha256"
        },
        "organization": {"id": 12345},
        "validity_years": 1,
        "payment_method": "balance",
        "auto_renew": 30
    }'
```

### Automation: ACME with DigiCert

DigiCert supports ACME for DV and OV certificates. CertCentral ACME enables automated issuance:

```bash
# DigiCert ACME directory URL (CertCentral)
# DV: https://acme.digicert.com/v2/OV/directory
# OV: https://acme.digicert.com/v2/OV/directory

# certbot with DigiCert ACME
certbot certonly \
    --server https://acme.digicert.com/v2/OV/directory \
    --eab-kid <eab-kid-from-certcentral> \
    --eab-hmac-key <eab-hmac-key-from-certcentral> \
    --email admin@example.com \
    --agree-tos \
    --standalone \
    -d example.com

# cert-manager ClusterIssuer for DigiCert ACME
```

```yaml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: digicert-ov-acme
spec:
  acme:
    server: https://acme.digicert.com/v2/OV/directory
    email: admin@example.com
    externalAccountBinding:
      keyID: <eab-kid>
      keySecretRef:
        name: digicert-eab-hmac
        key: secret
    solvers:
    - http01:
        ingress:
          class: nginx
```

---

## Trust Lifecycle Manager (TLM)

### Key Capabilities

**Certificate Discovery**:
- Network scanner: CIDR range scans with TLS handshake
- Cloud native: AWS ACM, Azure Key Vault, GCP Certificate Manager
- Kubernetes: cert-manager integration, namespace scanning
- Agent-based: Windows/Linux agents for local certificate stores

**Policy Enforcement**:
```
Policy examples:
  - No SHA-1 or MD5 signatures
  - RSA key >= 2048 bits, ECDSA >= P-256
  - Maximum validity: 397 days (leave buffer below 398)
  - Issuing CA must be in approved list
  - Subject must include Organization (OV minimum)
  - Alert threshold: 60 days before expiry
  - Block threshold: 30 days before expiry (require renewal)
```

**Automation Workflows**:
- Trigger: Certificate expiry approaching
- Action: Request renewal from same or different CA
- Deliver: Deploy to endpoint (F5, A10, IIS, nginx, Kubernetes)
- Notify: Slack/Teams/email on success or failure

### TLM API

TLM uses the DigiCert ONE API framework:

```bash
# Base URL
https://one.digicert.com

# Authentication: API key in header
X-ONE-DEVKEY: <api-key>

# List certificates
GET /mpki/api/v1/certificate?status=Active&expiring_in_days=90

# Issue a certificate
POST /mpki/api/v1/certificate
{
  "profile": {"id": "<profile-id>"},
  "seat": {"seat_id": "<seat-id>"},
  "enrollment_source": "API",
  "csr": "<PEM-encoded-CSR>",
  "validity": {"days": 397}
}
```

---

## CT Log Monitoring

DigiCert provides CT log monitoring for domains you own:

1. **Verify domain ownership** in CertCentral
2. **Enable CT monitoring** for the verified domain
3. **Receive alerts** when any CA issues a certificate for your domain

Manual monitoring via crt.sh:
```bash
# Find all certificates for a domain
curl "https://crt.sh/?q=example.com&output=json" | jq '.[] | {cn: .common_name, issuer: .issuer_name, not_after: .not_after}'

# Find certificates with specific SAN
curl "https://crt.sh/?q=%.example.com&output=json"
```

### Setting Up CAA to Restrict Issuance to DigiCert

```dns
example.com. IN CAA 0 issue "digicert.com"
example.com. IN CAA 0 issuewild "digicert.com"
example.com. IN CAA 0 iodef "mailto:security@example.com"
```

---

## Best Practices

### Certificate Ordering

1. **Use SANs, not separate certificates**: Multi-SAN certificates reduce cost and management overhead
2. **Match validation level to use case**: DV for internal/dev, OV for production APIs, EV for payment pages
3. **Set auto-renewal**: Enable `auto_renew` in API orders (renew X days before expiry)
4. **Use 2048-bit RSA or P-256 ECDSA**: No benefit to 4096-bit for most use cases; just slower

### Certificate Lifecycle

1. **ACME where possible**: Automate issuance and renewal; eliminate manual processes
2. **Store private keys in HSM or secrets manager**: Never commit to VCS
3. **Inventory ALL certificates**: Use TLM discovery to find shadow IT certificates
4. **Monitor expiry independently**: Don't rely solely on CA renewal notifications
5. **Alert at 60 days, escalate at 30 days**: Provides time for approval workflows and deployment

### Code Signing

1. **EV for production software releases**: Immediate SmartScreen reputation
2. **Hardware token or DigiCert KeyLocker**: Required by CA/B Forum since June 2023
3. **Limit signing to CI/CD pipeline**: Never allow developers to sign with production keys locally
4. **Timestamp all signatures**: Timestamps extend validity beyond certificate expiry for already-signed code