Description

DigiCert replacing multiple intermediate CA certificates (ICAs).

We are replacing ICAs to:

• Promote agility with ICA replacement.
• Reduce the likelihood of pinning ICA certificates or hard coding ICA certificate trust, which makes replacing these certificates difficult.
• Reduce the scope of certificate issuance from any given ICA to mitigate the impact of changes in industry and CA/Browser Forum guidelines to intermediate and end-entity certificates.

What are ICA certificates used for?

Certificate Authorities (CAs) use intermediate CA (ICA) certificates to issue certificates such as your SSL/TLS certificates. The ICA certificate links your certificate to the trusted root certificate enabling browsers and other applications to trust it.

How do new ICA certificates affect me?

No action is required, unless you do any of the following:

• Pin the old versions of replaced intermediate CA certificates
• Hard code the acceptance of the old versions of replaced intermediate CA certificates
• Operate a trust store that includes the old versions of replaced intermediate CA certificates

If you do any of the above, we recommend updating your environment as soon as possible. Stop pinning and hard coding ICA certificate acceptance or make the necessary changes to ensure certificates issued from the new ICA certificates are trusted (in other words, can chain up to their ICA and trusted root certificates).

How does ICA replacement affect existing certificates?

Rolling out new ICA certificates does not affect existing certificates. We don't remove an old ICA from certificate stores until all the certificates issued from it have expired. This means active certificates issued from a replaced ICA certificate continue to be trusted.

However, it does affect those certificates if you reissue them, as the reissued certificate is issued from the new ICA certificate. This means you will need to include the provided ICA certificate when you install the reissued certificate.

Best practice

We recommend that you always include the provided ICA with every certificate you install. This has always been the recommended best practice to ensure ICA certificate replacements go unnoticed and to make sure certificates are trusted.

November 2020: ICA certificate replacements

On November 2, 2020, DigiCert is replacing the ICAs listed below. We encourage you to update key stores, needed code, and certificate pinnings that may be in use.

• DigiCert SHA2 Secure Server CA
• DigiCert Baltimore CA-2 G2
• DigiCert Global CA G2
• DigiCert ECC Secure Server CA
• DigiCert Baltimore CA-1 G2
• DigiCert Global CA G3
• DigiCert Trusted Server CA G4
• DigiCert ECC Extended Validation Server CA
• DigiCert Assured ID CA G2
• DigiCert Extended Validation CA G3
• DigiCert High Assurance CA-3
• DigiCert EV Server CA G4

Intermediate CA certificate replacements

To download copies of intermediate CA and root certificates, see the DigiCert Trusted Root Authority Certificates page. This is an active page that we update as roots and intermediate CA certificates become publicly available.

November 2020 ICA Replacements

July 2020 DV ICA Replacements