Knowledge Base

Description

The industry will soon require Certificate Authorities (CAs) to start issuing TLS/SSL certificates from single-purpose roots that chain to single-purpose ICA certificates. To prepare for this change, DigiCert has created new, single-purpose, public, fifth-generation (G5) root and intermediate CA (ICA) certificate hierarchies for issuing public TLS/SSL certificates.

DigiCert is working hard to ensure the G5 roots are included in all necessary certificate trust stores to improve root ubiquity and reduce the need to install a cross-signed root certificate to ensure TLS/SSL certificate trust.

However, even once the roots have been added to the trust stores, you can’t guarantee that users will immediately update their systems, browsers, or applications to the latest versions. To ensure your certificates are trusted even when the new G5 root is missing from a needed trust store, DigiCert recommends installing a DigiCert G5 cross-signed root CA certificate.

Cross-signed root CA certificate compatibility

Installing the cross-signed root CA certificate will ensure your certificates remain trusted with the following operating systems and clients: 

Install your DigiCert cross-signed root CA certificate

When DigiCert sends your certificate issued from the G5 certificate chain, we will include the certificates listed below. You can also download this zip file from your DigiCert account. This file may contain additional files based on the server platform you selected when ordering or downloading the certificate from your account

Zip file certificates:

• TLS/SSL certificate
• G5 Intermediate CA
• Cross-signed root CA

See the Download intermediate CA and cross-signed root CA certificates table below to download copies of these certificates now.

Install cross-signed root CA certificate

1. Use your text editor (such as Notepad) to open the cross-signed Root CA file. 
2. In your editor, copy all the contents. 
3. Use your text editor to open the G5 Intermediate CA file
4. Paste the contents of the cross-signed Root CA file to the end of the G5 Intermediate CA file.
5. Save your updated G5 Intermediate CA file.
   
   
6. Now, you are ready to install your certificate on your server, and your certificate will be trusted if it can’t find its new G5 root in a needed trust store.

Download intermediate CA and cross-signed root CA certificates

RSA TLS/SSL certificates

ECC TLS/SSL certificates