Skip to content

DigiCert CertCentral

TL;DR

DigiCert CertCentral is a SaaS certificate management platform tightly integrated with DigiCert's public CA services. It provides certificate discovery, lifecycle management, and automation primarily for organizations using DigiCert as their CA. Best suited for companies seeking integrated CA + management solution without separate platform licensing.

Key differentiator: Seamless integration between CA and management platform, included with DigiCert certificates.

Overview

CertCentral represents DigiCert's answer to enterprise certificate management, bundling management capabilities with their CA services. Unlike standalone certificate management platforms (Venafi, Keyfactor), CertCentral is primarily a management interface for DigiCert-issued certificates, though it can discover and track certificates from other CAs.

Target market:

  • Mid-size to large enterprises (1,000-50,000 employees)
  • Organizations standardized on DigiCert CA
  • Companies wanting integrated CA + management
  • Businesses seeking SaaS-only solution
  • Organizations with 5,000-100,000 certificates

Evolution:

  • Originally DigiCert's customer portal
  • Enhanced into management platform (~2015)
  • Acquired Symantec Website Security business (2017)
  • Continuous feature additions competing with standalone platforms

Core Capabilities

Certificate Lifecycle Management

Enrollment and issuance: 

certificate_types_supported:
  tls_ssl:
    - standard_ssl_tls
    - extended_validation_ev
    - organization_validated_ov
    - domain_validated_dv
    - wildcard
    - multi_domain_san
    - multi_year_plans  # Pay upfront, issue annually

  code_signing:
    - standard_code_signing
    - ev_code_signing
    - microsoft_trusted_signing

  client_authentication:
    - client_certificates
    - vpn_certificates
    - email_encryption_smime

  document_signing:
    - pdf_signing
    - document_trust_manager

Automation features:

  • ACME protocol support (limited)
  • REST API for integrations
  • Bulk certificate operations
  • Automated renewal workflows
  • Pre-approved domains for fast issuance

Discovery and Visibility

Discovery capabilities: 

# CertCentral Discovery API example (conceptual)
class CertCentralDiscovery:
    """
    CertCentral discovery focuses on DigiCert-issued certificates
    Plus network scanning for visibility
    """

    def discover_digicert_certificates(self):
        """
        Built-in: All DigiCert issued certificates automatically tracked
        """
        return {
            'automatic_tracking': True,
            'includes': [
                'active_certificates',
                'pending_requests',
                'revoked_certificates',
                'expired_certificates (90 days)'
            ]
        }

    def network_scan_discovery(self, ip_ranges: List[str]):
        """
        Optional: Discover non-DigiCert certificates
        """
        scan_config = {
            'scan_type': 'network',
            'ip_ranges': ip_ranges,
            'ports': [443, 8443, 9443],
            'frequency': 'weekly',
            'includes_non_digicert': True  # Can see competitor certs
        }
        return scan_config

Visibility features:

  • All DigiCert certificates automatically visible
  • Network scanning discovers non-DigiCert certs (read-only)
  • Certificate inventory dashboard
  • Expiry tracking and alerts
  • Usage analytics

Limitations:

  • Cannot manage non-DigiCert certificates
  • Discovery less comprehensive than Venafi/Keyfactor
  • No agent-based discovery
  • Limited visibility into application-level cert stores

Automation and Integration

ACME support: 

# CertCentral ACME endpoint
certbot certonly \
    --server https://acme.digicert.com/v2/acme/directory/ACCOUNT_ID \
    --domain example.com \
    --email [email protected] \
    --agree-tos

# Limitations:
# - Requires CertCentral account setup
# - Only for DV (Domain Validated) certificates
# - OV/EV certificates still require manual processes

API capabilities: 

import requests

class DigiCertAPI:
    """
    CertCentral REST API client
    """

    def __init__(self, api_key: str):
        self.base_url = "https://www.digicert.com/services/v2"
        self.headers = {
            'X-DC-DEVKEY': api_key,
            'Content-Type': 'application/json'
        }

    def order_certificate(
        self,
        common_name: str,
        sans: List[str],
        organization_id: int,
        validity_years: int = 1
    ) -> dict:
        """
        Order new SSL certificate
        """
        payload = {
            'certificate': {
                'common_name': common_name,
                'dns_names': sans,
                'csr': self.generate_csr(common_name, sans),
            },
            'organization': {
                'id': organization_id
            },
            'validity_years': validity_years,
            'auto_renew': 0  # 0=no, 12=12 months before expiry, etc.
        }

        response = requests.post(
            f"{self.base_url}/order/certificate/ssl_plus",
            json=payload,
            headers=self.headers
        )

        return response.json()

    def list_expiring_certificates(self, days: int = 30) -> List[dict]:
        """
        Get certificates expiring soon
        """
        params = {
            'filters[expires_in]': days
        }

        response = requests.get(
            f"{self.base_url}/certificate",
            params=params,
            headers=self.headers
        )

        return response.json()['certificates']

    def renew_certificate(self, order_id: str) -> dict:
        """
        Renew existing certificate
        """
        response = requests.post(
            f"{self.base_url}/order/certificate/{order_id}/reissue",
            headers=self.headers
        )

        return response.json()

Integration ecosystem:

  • Limited compared to Venafi/Keyfactor
  • Focus on DigiCert certificate operations
  • Basic integrations with major platforms
  • Webhook support for events
  • Some ITSM integrations (ServiceNow)

Organizational Management

Multi-entity support: 

organization_structure:
  divisions:
    - engineering
    - marketing
    - operations

  access_control:
    roles:
      - admin  # Full access
      - finance  # Billing and reports
      - user  # Request and view
      - api  # API access only

  delegation:
    - division_admins: Can manage their division's certificates
    - cost_centers: Track spending by division
    - approval_workflows: Optional approval for certificate requests

Billing and cost tracking:

  • Centralized billing across divisions
  • Usage reports by division/cost center
  • Budget alerts
  • Volume discounts automatically applied
  • Multi-year payment plans

Deployment Model

SaaS Only: 

┌─────────────────────────────────────────────┐
│         DigiCert CertCentral (SaaS)         │
│                                             │
│  User Interface (Web Portal)                │
│          │                                  │
│          ├─── Certificate Management        │
│          ├─── Discovery Dashboard           │
│          ├─── Reports & Analytics           │
│          └─── User Management               │
│                                             │
│  API Layer                                  │
│          │                                  │
│          ├─── REST API                      │
│          ├─── ACME API (DV only)            │
│          └─── Webhooks                      │
│                                             │
│  DigiCert CA Infrastructure                 │
│          │                                  │
│          ├─── Certificate Issuance          │
│          ├─── Validation Systems            │
│          └─── OCSP/CRL Services             │
└─────────────────────────────────────────────┘
                    │
        ┌───────────┴──────────┐
        ▼                      ▼
   Network Scanners       Customer Infrastructure
   (Optional add-on)      (Deployment target)

No on-premises option:

  • Pure SaaS model only
  • DigiCert manages all infrastructure
  • Automatic updates and maintenance
  • No customer infrastructure required

Benefits:

  • Zero infrastructure overhead
  • Always up-to-date
  • Predictable operations
  • Immediate access

Limitations:

  • No air-gapped deployment
  • Limited customization
  • Dependent on DigiCert availability
  • Must accept DigiCert's update schedule

Pricing Model

Included with DigiCert certificates:

  • CertCentral access included with certificate purchases
  • No separate platform licensing fee
  • Cost is certificate cost + optional add-ons

Certificate pricing (approximate list prices): 

SSL/TLS Certificates:
├── Standard SSL (DV)
│   ├── Single domain: $200-300/year
│   ├── Wildcard: $600-800/year
│   └── Multi-domain (SAN): $300-600/year
│
├── Organization Validated (OV)
│   ├── Single domain: $400-600/year
│   ├── Wildcard: $1,200-1,500/year
│   └── Multi-domain (SAN): $600-1,000/year
│
├── Extended Validation (EV)
│   ├── Single domain: $800-1,200/year
│   └── Multi-domain (SAN): $1,000-1,500/year
│
└── Multi-year plans
    └── Pay upfront, save 10-30%

Code Signing:
├── Standard: $400-600/year
└── EV Code Signing: $600-800/year

Volume discounts:

  • 10-100 certificates: 10-20% discount
  • 100-1,000 certificates: 20-40% discount
  • 1,000+ certificates: 40-60% discount
  • Enterprise agreements: Custom pricing

Optional add-ons:

  • Discovery scanning: ~$5,000-15,000/year
  • Priority support: ~$10,000-25,000/year
  • Advanced automation features: Negotiated
  • Professional services: Hourly or project-based

Example total costs:

  • 1,000 certificates (OV): ~$300,000-400,000/year (with discounts)
  • 10,000 certificates (OV): ~$2M-3M/year (with volume discounts)
  • 100,000 certificates: Custom enterprise pricing

Cost considerations:

  • Lower total cost than Venafi for DigiCert-only environments
  • Higher per-certificate cost than Let's Encrypt (but includes validation)
  • Competitive with other public CAs (Sectigo, Entrust, GlobalSign)
  • No platform licensing saves vs. Venafi/Keyfactor

Strengths

Integrated Solution

Seamless CA + Management:

  • Single vendor relationship
  • Unified billing
  • No integration headaches between CA and management platform
  • Consistent support experience

Automatic discovery:

  • All DigiCert certificates automatically tracked
  • No manual inventory synchronization
  • Real-time visibility into certificate status
  • Immediate alerts on expiry or issues

Simplified Operations

Lower operational complexity:

  • SaaS-only reduces infrastructure burden
  • Automatic updates with no downtime
  • No platform upgrades to manage
  • Scales automatically with usage

Easier onboarding:

  • Intuitive web interface
  • Less training required than Venafi
  • Faster time to value
  • Built-in best practices

Strong CA Reputation

DigiCert trust:

  • One of most trusted public CAs
  • Broad browser/device compatibility
  • Strong security track record
  • Industry leadership in standards

Validation quality:

  • Rigorous OV/EV validation processes
  • Fast validation turnaround
  • Clear validation requirements
  • Good customer support

Cost-Effective for DigiCert Users

No separate platform fee:

  • Management included with certificates
  • Predictable per-certificate pricing
  • Volume discounts available
  • Lower total cost than Venafi + public CA

Weaknesses

DigiCert-Centric

Limited multi-CA support:

  • Can only manage DigiCert certificates
  • Other CA certs are discovery-only (read-only)
  • No automation for non-DigiCert certificates
  • Vendor lock-in to DigiCert as CA

Migration challenges:

  • Difficult to switch CAs while using CertCentral
  • Would lose management capabilities for new CA
  • Forces continued DigiCert usage
  • Competitive CAs not supported for management

Limited Automation

Basic automation:

  • ACME only for DV certificates
  • No automated deployment to endpoints
  • Limited workflow automation
  • Manual processes for OV/EV

Integration gaps:

  • Fewer integrations than Venafi/Keyfactor
  • No agent-based deployment
  • Limited platform support
  • Manual deployment to most systems

Scalability Concerns

Not built for extreme scale:

  • Works well up to ~100,000 certificates
  • Beyond that, consider purpose-built platforms
  • Performance issues reported by very large customers
  • UI becomes cumbersome at scale

Discovery limitations:

  • Network scanning is add-on, not core feature
  • No comprehensive discovery like Venafi
  • Can miss certificates deployed manually
  • Limited visibility into application stores

SaaS-Only Constraints

No on-premises option:

  • Cannot deploy in air-gapped environments
  • Government/defense customers may be excluded
  • Data residency concerns for some industries
  • Dependent on DigiCert's infrastructure

Limited customization:

  • Cannot modify workflows substantially
  • Must accept DigiCert's UI/UX
  • Limited policy customization
  • Feature requests require DigiCert development

Comparison to Competitors

Feature DigiCert CertCentral Venafi Platform Keyfactor Command
Deployment SaaS only On-prem/SaaS On-prem/SaaS
Multi-CA DigiCert only* Yes Yes
Integrations Basic 200+ 100+
Cost Model Per-certificate Platform + per-cert Platform + per-cert
Automation Basic Advanced Advanced
Scale 100K certs 1M+ certs 500K+ certs
Discovery Limited Comprehensive Comprehensive
Learning Curve Easy Steep Moderate
Best For DigiCert customers Large enterprises Growing enterprises

*Can discover but not manage non-DigiCert certificates

Use Cases

Ideal Scenarios

Mid-size company standardized on DigiCert:

  • Profile: 5,000 employees, 20,000 certificates
  • Challenge: Manual certificate tracking in spreadsheets
  • Solution: CertCentral for visibility and renewal management
  • Results: Eliminated expiry outages, reduced admin time 60%

E-commerce platform migration:

  • Profile: Moving from Symantec to DigiCert
  • Challenge: Tracking certificates during migration
  • Solution: CertCentral's Symantec-to-DigiCert migration tools
  • Results: Smooth migration, zero downtime, complete visibility

Growing SaaS company:

  • Profile: 500 employees, 5,000 certificates, rapid growth
  • Challenge: Outgrown manual processes, can't afford Venafi
  • Solution: CertCentral for automation without platform cost
  • Results: Scaled to 15,000 certs without additional staff

When CertCentral Makes Sense

Strong fit:

  • Already using DigiCert as primary CA
  • 5,000-50,000 certificates
  • Want integrated CA + management
  • Prefer SaaS over on-premises
  • Budget-conscious (avoid separate platform licensing)
  • Mid-size enterprise (1,000-10,000 employees)
  • Limited PKI team (<5 people)

Weak fit:

  • Multi-CA strategy required
  • Need on-premises deployment
  • Require extensive automation

  • 100,000 certificates

  • Need comprehensive discovery
  • Want platform-agnostic solution
  • Regulated industry with data residency requirements

Implementation Guide

Getting Started

Prerequisites: 1. DigiCert account (or establish new account) 2. Validated organization in DigiCert system 3. Pre-approved domains (for fast issuance) 4. API key (for automation) 5. User access model defined

Initial setup (1-2 weeks): 

implementation_steps:
  week_1:
    - setup_organization_structure
    - configure_user_roles
    - validate_domains
    - configure_notification_preferences
    - import_existing_certificates  # If migrating

  week_2:
    - pilot_certificate_requests
    - test_automation_workflows
    - configure_integrations
    - train_administrators
    - document_procedures

Best practices:

  • Start with DV certificates for learning
  • Use API for bulk operations
  • Configure webhooks for alerting
  • Enable auto-renewal where possible
  • Regular inventory audits

Migration from Other Solutions

From manual processes: 1. Export existing certificate inventory to CSV 2. Upload to CertCentral for tracking 3. Standardize on DigiCert for new certificates 4. Gradually replace expiring certificates 5. Retire old manual tracking systems

From Symantec/Norton:

  • DigiCert provides migration tools
  • Automated import of Symantec certificates
  • Grace period for replacement
  • Technical migration support included

From other CAs:

  • Will lose management capabilities
  • CertCentral becomes discovery-only for old certs
  • Plan certificate replacement schedule
  • Consider hybrid period with multiple tools

API and Automation Examples

Automated renewal workflow:

import schedule
import time
from datetime import datetime, timedelta

class AutoRenewalBot:
    """
    Automated certificate renewal for CertCentral
    """

    def __init__(self, api_key: str):
        self.client = DigiCertAPI(api_key)

    def check_and_renew(self):
        """
        Check for expiring certificates and renew
        """
        # Get certificates expiring in 30 days
        expiring = self.client.list_expiring_certificates(days=30)

        for cert in expiring:
            print(f"Certificate {cert['common_name']} expires {cert['valid_till']}")

            # Check if already renewed
            if cert.get('renewal_order_id'):
                print(f"  Already renewed: {cert['renewal_order_id']}")
                continue

            # Renew certificate
            try:
                result = self.client.renew_certificate(cert['id'])
                print(f"  Renewed: Order #{result['id']}")

                # Send notification
                self.send_notification(
                    f"Certificate {cert['common_name']} renewed automatically"
                )
            except Exception as e:
                print(f"  Renewal failed: {e}")
                self.send_alert(
                    f"MANUAL ACTION REQUIRED: {cert['common_name']} renewal failed"
                )

    def run_daily(self):
        """Run renewal check daily"""
        schedule.every().day.at("02:00").do(self.check_and_renew)

        while True:
            schedule.run_pending()
            time.sleep(3600)  # Check every hour

# Usage
bot = AutoRenewalBot(api_key="your-api-key")
bot.run_daily()

Conclusion

DigiCert CertCentral is a pragmatic choice for organizations already committed to DigiCert as their Certificate Authority. It provides essential certificate management capabilities without the cost and complexity of standalone platforms like Venafi or Keyfactor.

Choose CertCentral if:

  • Using or planning to use DigiCert for certificates
  • Managing 5,000-50,000 certificates
  • Want simplicity over feature richness
  • Prefer SaaS-only deployment
  • Budget-conscious about PKI management
  • Have small-to-medium PKI team

Consider alternatives if:

  • Need multi-CA flexibility
  • Require on-premises deployment
  • Managing >100,000 certificates
  • Need advanced automation/integration
  • Want comprehensive discovery capabilities
  • Require platform-agnostic solution

CertCentral's value proposition is simplicity: "Buy DigiCert certificates, get management for free." For organizations where this model aligns with their CA strategy, it's an excellent choice that eliminates integration complexity and reduces total cost. For those requiring platform flexibility or advanced capabilities, purpose-built certificate management platforms (Venafi, Keyfactor) remain better options despite higher costs.

References

Official DigiCert Resources

  1. DigiCert CertCentral Platform
    Digicert - Certcentral
    Official product page and feature overview

  2. CertCentral User Guide
    Digicert - Certcentral
    Comprehensive platform documentation

  3. DigiCert Services API
    Digicert - Documentation
    REST API reference for automation

  4. DigiCert ACME Directory
    DigiCert Third-party ACME Integration
    ACME protocol implementation and third-party client integration

  5. DigiCert Trust Center
    DigiCert - What is Digital Trust
    Security practices and digital trust information

Certificate Authority Standards

  1. CA/Browser Forum Baseline Requirements
    Cabforum - Baseline Requirements Documents
    Industry standards DigiCert follows for certificate issuance

  2. WebTrust for Certification Authorities
    CPA Canada - WebTrust Services
    Audit standards for certificate authorities

  3. ETSI EN 319 411 - EU Standards
    Etsi
    European certificate authority requirements

  4. RFC 5280 - X.509 Certificate Profile
    Ietf - Rfc5280
    Certificate format and validation standards

  5. RFC 8555 - ACME Protocol
    Ietf - Rfc8555
    Automated certificate management protocol

DigiCert Certificate Types

  1. SSL/TLS Certificate Options
    DigiCert TLS/SSL Certificates
    DV, OV, EV certificate products

  2. Code Signing Certificates
    Digicert - Code Signing
    Standard and EV code signing options

  3. S/MIME Email Certificates
    Digicert - Secure Email
    Email encryption and signing certificates

  4. Document Signing Certificates
    Digicert - Document Signing
    PDF and document signing solutions

  5. IoT Device Certificates
    Digicert - Iot
    PKI for connected devices

Integration and Automation

  1. Certbot with DigiCert
    Eff
    ACME client integration for DV certificates

  2. acme.sh DigiCert Support
    Github - Acme.Sh
    Alternative ACME client with DigiCert support

  3. Python DigiCert API Client
    Github - Digicert
    Community SDK for API integration

  4. Terraform DigiCert Provider
    Terraform
    Infrastructure-as-code certificate management

  5. PowerShell DigiCert Module
    Powershellgallery
    Windows automation for DigiCert operations

Validation and Compliance

  1. Domain Validation (DV) Process
    Digicert Documentation
    Automated domain ownership verification

  2. Organization Validation (OV) Requirements
    Digicert Documentation
    Business verification process

  3. Extended Validation (EV) Standards
    Digicert Documentation
    Rigorous identity verification for EV certificates

  4. Certificate Transparency Logging
    Transparency
    Public logging of issued certificates

  5. DigiCert CT Log Monitoring
    DigiCert - What are CT Logs
    Certificate transparency services

Pricing and Licensing

  1. DigiCert Pricing Calculator
    DigiCert Certificates at CheapSSL Security
    Certificate pricing and options

  2. Volume Discount Programs
    Digicert
    Enterprise pricing structure

  3. Multi-Year Certificate Plans
    Digicert
    Prepaid certificate programs

  4. Partner Program Pricing
    Digicert - Partners
    Reseller and partner pricing

  5. Enterprise Agreement Options
    Digicert
    Custom pricing for large deployments

Security and Trust

  1. DigiCert Root Certificate Store
    Digicert - Digicert Root Certificates.Htm
    Root and intermediate CA certificates

  2. Browser and Device Compatibility
    Digicert
    Platform trust and compatibility matrix

  3. OCSP and CRL Services
    Digicert
    Revocation checking infrastructure

  4. Security Incident Response
    Digicert
    Certificate compromise and revocation procedures

  5. DigiCert Security Operations
    DigiCert - What is Digital Trust
    CA security practices and controls

Migration and Deployment

  1. Symantec to DigiCert Migration
    Digicert - Symantec Migration
    Tools and guidance for Symantec customer migration

  2. Certificate Installation Guides
    Digicert - Ssl Certificate Installation.Htm
    Platform-specific installation instructions

  3. Server Configuration Tools
    Digicert - Ssl Support.Htm
    SSL/TLS configuration assistance

  4. Certificate Checker Utility
    Digicert - Help
    Online certificate validation tool

  5. CSR Decoder and Generator
    Digicert - Csr Creation.Htm
    Certificate request tools

Industry Analysis

  1. Gartner: DigiCert Analysis
    Gartner
    Market positioning and capabilities assessment

  2. Forrester Wave: Public PKI
    Forrester
    Competitive evaluation of public CAs

  3. Netcraft SSL Survey
    Netcraft - Ssl Survey
    Market share and deployment statistics

  4. SSL Pulse by Qualys
    Ssllabs - Ssl Pulse
    Industry SSL/TLS deployment trends

  5. Certificate Transparency Statistics
    Crt
    DigiCert issuance volume and trends

Use Cases and Case Studies

  1. E-Commerce Platform Deployments
    Digicert - Case Studies
    Retail and online marketplace implementations

  2. Financial Services Security
    Digicert - Case Studies
    Banking and fintech certificate management

  3. Healthcare HIPAA Compliance
    Digicert - Case Studies
    Healthcare organization implementations

  4. SaaS Provider PKI
    Digicert - Case Studies
    Cloud service provider certificate strategies

  5. Government and Defense
    Digicert - Case Studies
    Public sector certificate deployments

Compliance and Regulatory

  1. PCI DSS Certificate Requirements
    Pcisecuritystandards
    Payment card industry compliance

  2. HIPAA Security Rule - Encryption
    Hhs - Hipaa
    Healthcare data protection requirements

  3. SOC 2 Type 2 for DigiCert
    Aicpa - Soc4So
    Service organization audit reports

  4. FedRAMP and DigiCert
    Fedramp
    Federal compliance considerations

  5. GDPR and Data Protection
    Gdpr
    European privacy regulation and encryption

Technical Standards

  1. TLS 1.3 Implementation
    Ietf - Rfc8446
    Modern TLS protocol support

  2. Certificate Pinning Best Practices
    Owasp
    Application security certificate practices

  3. OCSP Stapling Configuration
    Ietf - Rfc6066
    TLS extension for OCSP responses

  4. CAA DNS Records
    Ietf - Rfc8659
    Certificate authority authorization

  5. CT Precertificate Signing
    Ietf - Rfc6962
    Certificate transparency protocol

Community and Support

  1. DigiCert Support Portal
    Digicert
    Knowledge base and ticket system

  2. DigiCert Support Center
    Digicert Support
    Technical support and documentation resources

  3. DigiCert Blog
    Digicert - Blog
    Industry news and best practices

  4. DigiCert on GitHub
    Github - Digicert
    Open-source tools and integrations

  5. SSL/TLS Best Practices
    DigiCert TLS Best Practices Checklist
    Implementation guidance and security recommendations