> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# DigiCert CA (CertCentral Services API)

> Issue TLS or Code Signing certificates from DigiCert using the CertCentral Services API.

## Concept

Infisical can issue certificates directly from [DigiCert CertCentral](https://www.digicert.com/) using the [CertCentral Services API](https://dev.digicert.com/en/certcentral-apis/services-api.html). A single DigiCert CA in Infisical is configured for one purpose:

* **SSL/TLS** — issues OV and EV TLS server certificates under an SSL product entitlement on your account (for example `ssl_plus`).
* **Code Signing** — issues OV (`code_signing`) and EV (`code_signing_ev`) code-signing certificates against a CSR. The signing key must live on an HSM.

> [!NOTE]
>
> The product is fixed on the CA and applies to every certificate that CA issues. Each product allows a different range of subject values, and DigiCert checks those values when the order is placed, not when you create the request. For example, `ssl_wildcard` takes only a wildcard common name such as `*.example.com`.

## Prerequisites

* A [DigiCert App Connection](https://infisical.com/docs/integrations/app-connections/digicert.md) with a validated CertCentral API key.
* A CertCentral **Organization**. For code signing, DigiCert validates the organization the first time it's used for a code-signing order, which can take up to 3 business days.
* Entitlement to the product you intend to use (`ssl_plus`, `code_signing`, `code_signing_ev`, ...) on your CertCentral account.

> [!NOTE]
>
> Configuring a DigiCert CA requires a CertCentral account with administrator-level access (or a role with permission to manage organizations, products, and API keys). The API key used for the App Connection inherits the permissions of the CertCentral user that created it.

## Create a DigiCert certificate authority

> [tab] Infisical UI
>
> **1. Create a DigiCert App Connection**
>
> Follow the [DigiCert App Connection guide](https://infisical.com/docs/integrations/app-connections/digicert.md) to store your CertCentral API key in Infisical.
>
> **2. Create the External CA**
>
> In **Certificate Manager**, go to **Certificate Authorities**, select **Create CA** in the External Certificate Authorities section, choose **DigiCert CertCentral** as the type, and fill out the form:
>
> * **App Connection** — the DigiCert connection you created
> * **Organization** — the CertCentral organization that should appear on issued certificates
> * **Purpose** — `SSL / TLS` or `Code Signing`. The product list filters accordingly.
> * **Product** — the CertCentral entitlement this CA will issue under
> * **Verified Contact** (Code Signing only) — full contact info for the person DigiCert emails to approve first-time code-signing orders for this organization. All five fields required: **First Name**, **Last Name**, **Email**, **Job Title**, **Telephone** (E.164, e.g. `+15551234567`). DigiCert requires `job_title` and `telephone` on every verified contact for CS orders; referencing an existing CertCentral user by id alone is not enough. Once the organization has an active CS validation on file, DigiCert ignores this field.

> [tab] API
>
> To create a DigiCert Certificate Authority, make an API request to the [Create DigiCert CA](https://infisical.com/docs/api-reference/endpoints/certificate-authorities/digicert/create.md) API endpoint.
>
> ```bash Create a DigiCert CA (SSL) theme={"dark"}
> curl --request POST \
>   --url https://app.infisical.com/api/v1/pki/ca/digicert \
>   --header 'Content-Type: application/json' \
>   --data '{
>     "name": "digicert-ov",
>     "status": "active",
>     "configuration": {
>       "appConnectionId": "<digicert-app-connection-id>",
>       "organizationId": 112236,
>       "productNameId": "ssl_plus",
>       "purpose": "ssl"
>     }
>   }'
> ```
>
> ```bash Create a DigiCert CA (Code Signing) theme={"dark"}
> curl --request POST \
>   --url https://app.infisical.com/api/v1/pki/ca/digicert \
>   --header 'Content-Type: application/json' \
>   --data '{
>     "name": "digicert-cs",
>     "status": "active",
>     "configuration": {
>       "appConnectionId": "<digicert-app-connection-id>",
>       "organizationId": 112236,
>       "productNameId": "code_signing",
>       "purpose": "code_signing",
>       "verifiedContact": {
>         "firstName": "John",
>         "lastName": "Doe",
>         "email": "john.doe@example.com",
>         "jobTitle": "Security Engineer",
>         "telephone": "+15551234567"
>       }
>     }
>   }'
> ```

## Using a DigiCert code signing CA

A CA configured for code signing is used from the **Code Signing** product, not the TLS issuance flow. For creating signers, reusing orders, HSM requirements, reissue, renewal, and deletion behavior, see the dedicated guide:

> [card] [Code Signing with DigiCert](https://infisical.com/docs/documentation/platform/pki/guides/code-signing/digicert-code-signing.md)
>
> Issue code-signing certificates from this CA with an HSM-backed key.

## DigiCert validation workflow

When you request a certificate through a DigiCert CertCentral CA, the request moves through these states:

| State | Description |
| - | - |
| **Pending Validation** | DigiCert has accepted the order. Complete domain control validation in DigiCert CertCentral. |
| **Issued** | Infisical polls DigiCert and downloads the certificate once validation completes. Select **Trigger Validation** to force an immediate check. |
| **Failed** | If DigiCert doesn't issue within 24 hours. Complete validation on CertCentral and submit a new request. |

> [!NOTE]
>
> OV and EV certificates require manual domain validation on the DigiCert CertCentral side before issuance.

## FAQ

> [accordion] What happens when I revoke a DigiCert-issued certificate in Infisical?
>
> Revoking the certificate in Infisical immediately marks it `Revoked` in the local inventory
> **and** asks DigiCert CertCentral to revoke that certificate only, so other certificates on the
> same order stay valid. If the certificate was issued before individual DigiCert certificates were
> tracked and a newer certificate has since replaced it on the order, the revocation is refused, so
> revoke it in DigiCert CertCentral instead.
> Depending on your CertCentral account's revocation policy, DigiCert may queue that request for
> administrator approval before the certificate is actually revoked on their side.

> [accordion] What happens when a certificate is revoked in DigiCert CertCentral?
>
> It's marked `Revoked` in the inventory within a day. That includes a certificate replaced by a
> [reissue](https://infisical.com/docs/documentation/platform/pki/applications/certificate-renewal.md#reissuing-a-digicert-certificate),
> which DigiCert revokes within 72 hours when the reissue removes or changes a name.

## What's next

Now that your DigiCert CA is configured, set up the infrastructure to issue certificates:

> [card] [Certificate Profiles](https://infisical.com/docs/documentation/platform/pki/settings/profiles.md)
>
> Create a profile that references your DigiCert CA.

> [card] [Applications](https://infisical.com/docs/documentation/platform/pki/applications/overview.md)
>
> Create an Application, attach a profile, and configure enrollment.

> [card] [Enrollment Methods](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/overview)
>
> Choose how certificates are requested — API, ACME, EST, or SCEP.

> [card] [Quick Start](https://infisical.com/docs/documentation/platform/pki/quick-starts/issue-first-certificate.md)
>
> Issue your first certificate end-to-end.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.