Ask a Question

Advanced Search

Alert ID : AL170720213619

Last Modified : 06/15/2021

Share Via Email

DigiCert ICA Update

URGENT

Description

DigiCert replaced multiple intermediate CA certificates (ICAs).

 

We replaced ICAs to:

  • Promote agility with ICA replacement.
  • Reduce the likelihood of pinning ICA certificates or hard coding ICA certificate trust, which makes replacing these certificates difficult.
  • Reduce the scope of certificate issuance from any given ICA to mitigate the impact of changes in industry and CA/Browser Forum guidelines for intermediate and end-entity certificates.
 

What are ICA certificates used for?

Certificate Authorities (CAs) use intermediate CA (ICA) certificates to issue certificates such as your SSL/TLS certificates. The ICA certificate links your certificate to the trusted root certificate enabling browsers and other applications to trust it.

 

How do new ICA certificates affect me?

No action is required, unless you do any of the following:

  • Pin the old versions of replaced intermediate CA certificates
  • Hard code the acceptance of the old versions of replaced intermediate CA certificates
  • Operate a trust store that includes the old versions of replaced intermediate CA certificates

If you do any of the above, we recommend updating your environment as soon as possible. Stop pinning and hard coding ICA certificate acceptance or make the necessary changes to ensure certificates issued from the new ICA certificates are trusted (in other words, can chain up to their ICA and trusted root certificates).

 

How does ICA replacement affect existing certificates?

Rolling out new ICA certificates does not affect existing certificates. We don't remove an old ICA from certificate stores until all the certificates issued from it have expired. This means active certificates issued from a replaced ICA certificate continue to be trusted.

However, it does affect those certificates if you reissue them, as the reissued certificate is issued from the new ICA certificate. This means you will need to include the provided ICA certificate when you install the reissued certificate.

 

Best practice

We recommend that you always include the provided ICA with every certificate you install. This has always been the recommended best practice to ensure ICA certificate replacements go unnoticed and to make sure certificates are trusted.

 

Intermediate CA certificate replacements

To download copies of intermediate CA and root certificates, see the DigiCert Trusted Root Authority Certificates page. This is an active page that we update as roots and intermediate CA certificates become publicly available.

June 2021 EV and OV ICA Replacements

DigiCert replaced the ICAs listed below on June 9, 2021.
 
We encourage you to update key stores, code bases, and certificate pinnings that may be in use. Customers impacted by these ICA changes, such as those utilizing ca_cert_id parameter, should contact their account manager or our support teams to explore options. 
 
This change was made to restore compatibility with Google Chrome’s EV indicators.
 
The new ICAs have the same Subject Name and key pair. Customers pinning to either of these values do not need to make any changes. Customers pinning to any other field, such as certificate serial number must update their pinning configuration immediately. Note that DigiCert does not recommend pinning because of operational risks.
 


New ICA New Serial
DigiCert TLS RSA SHA256 2020 CA1 06d8d904d5584346f68a2fa754227ec4
DigiCert Global G3 TLS ECC SHA384 2020 CA1 0b00e92d4d6d731fca3059c7cb1e1886
DigiCert TLS Hybrid ECC SHA384 2020 CA1 07f2f35c87a877af7aefe947993525bd
DigiCert G5 TLS ECC SHA384 2021 CA1 041c5d282eb3710e6b72c2dabd26716f
DigiCert G5 TLS RSA4096 SHA384 2021 CA1 0e6458e754ec9cc7bac83231d5f94d58
DigiCert G5 RSA4096 SHA384 2021 CA1 0e8d2840ae4825905618b3a8a9e17a47
DigiCert G5 ECC SHA384 2021 CA1 060e453e9bf768c659336a5b02b47113
 

July 2020 DV ICA Replacements

 

Old ICA certificate

New ICA certificate

Issuing root certificate

 OCSP CRL

GeoTrust RSA CA 2018 (SHA256RSA)

GeoTrust TLS DV RSA Mixed SHA256 2020 CA-1

DigiCert Global Root CA

http://ocsp.digicert.com

http://crl3.digicert.com
http://crl4.digicert.com

RapidSSL RSA CA 2018 (SHA256RSA)

RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1

DigiCert Global Root CA

http://ocsp.digicert.com

http://crl3.digicert.com
http://crl4.digicert.com

 

November 2020 ICA Replacements


DigiCert replaced the ICAs listed below on November 2, 2020.
We encourage you to update key stores, needed code, and certificate pinnings that may be in use.

 

Old ICA certificate

New ICA certificate

Issuing root certificate

 OCSP CRL

DigiCert SHA2 Secure Server CA

DigiCert TLS RSA SHA256 2020 CA1

Note: This will be the new default issuing ICA certificate.

DigiCert Global Root CA

http://ocsp.digicert.com

http://crl3.digicert.com
http://crl4.digicert.com

DigiCert SHA2 Secure Server CA           

DigiCert SHA2 Secure Server CA

DigiCert Global Root CA

http://ocsp.digicert.com

http://crl3.digicert.com
http://crl4.digicert.com

DigiCert Baltimore CA-2 G2

DigiCert Baltimore TLS RSA SHA256 2020 CA1

Baltimore CyberTrust Root

http://ocsp.digicert.com

http://crl3.digicert.com
http://crl4.digicert.com

DigiCert Global CA G2

DigiCert Global G2 TLS RSA SHA256 2020 CA1

DigiCert Global Root G2

http://ocsp.digicert.com

http://crl3.digicert.com
http://crl4.digicert.com

DigiCert ECC Secure Server CA

DigiCert TLS Hybrid ECC SHA384 2020 CA1

DigiCert Global Root CA

http://ocsp.digicert.com

http://crl3.digicert.com
http://crl4.digicert.com

DigiCert Baltimore CA-1 G2

DigiCert Baltimore SMIME RSA SHA256 2020 CA1

Baltimore CyberTrust Root

http://ocsp.digicert.com

http://crl3.digicert.com
http://crl4.digicert.com

DigiCert Global CA G3

DigiCert Global G3 TLS ECC SHA384 2020 CA1

DigiCert Global Root G3

http://ocsp.digicert.com

http://crl3.digicert.com
http://crl4.digicert.com

DigiCert Trusted Server CA G4

DigiCert Trusted G4 TLS RSA SHA384 2020 CA1

DigiCert Trusted Root G4

http://ocsp.digicert.com

http://crl3.digicert.com
http://crl4.digicert.com

DigiCert ECC Extended Validation Server CA

DigiCert TLS Hybrid ECC SHA384 2020 CA1

DigiCert Global Root CA

http://ocsp.digicert.com

http://crl3.digicert.com
http://crl4.digicert.com

DigiCert Assured ID CA G2

DigiCert Global G2 TLS RSA SHA256 2020 CA1

DigiCert Global Root G2

http://ocsp.digicert.com

http://crl3.digicert.com
http://crl4.digicert.com

DigiCert Extended Validation CA G3

DigiCert Global G3 TLS ECC SHA384 2020 CA1

DigiCert Global Root G3

http://ocsp.digicert.com

http://crl3.digicert.com
http://crl4.digicert.com

DigiCert High Assurance CA-3

DigiCert TLS RSA SHA256 2020 CA1

DigiCert Global Root CA

http://ocsp.digicert.com

http://crl3.digicert.com
http://crl4.digicert.com

DigiCert EV Server CA G4

DigiCert Trusted G4 TLS RSA SHA384 2020 CA1

DigiCert Trusted Root G4

http://ocsp.digicert.com

http://crl3.digicert.com
http://crl4.digicert.com