How to Renew a DigiCert SSL Certificate (Enterprise + SMB)

DigiCert TLS certs typically ship 1-2 year lifetimes for OV/EV, and 90-day lifetimes for their ACME-compatible offerings. Renewal is either through CertCentral (manual) or automated via ACME / API.

Prerequisites

DigiCert CertCentral account
Server access (or CDN admin) to install the renewed cert
Domain still under CAA policy allowing DigiCert (0 issue "digicert.com" — verify with the CAA record lookup)

Path 1 — CertCentral (Manual)

Log into DigiCert CertCentral
Certificates → Order Certificates → Renew (or click the expiring cert)
Generate a new CSR — either from CertCentral or from your server:
```
openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr
```
Paste the CSR into CertCentral.
Complete Domain Control Validation — DigiCert offers:
- Email DCV (approver email at your domain)
- DNS DCV (add a TXT record they specify)
- HTTP DCV (host a file at a URL they specify)
- Constructed email DCV ([email protected], hostmaster@, etc.)
Approve and issue — DigiCert emails the new cert (or download from CertCentral)

Install on your server:

sudo cp yourdomain.crt /etc/ssl/certs/
sudo cp yourdomain.key /etc/ssl/private/
sudo systemctl reload nginx  # or apache2

Path 2 — ACME Automation

DigiCert offers ACME-compatible endpoints for their newer product tiers. Use certbot or acme.sh with DigiCert’s ACME URL and API key:

certbot --server https://acme.digicert.com/v2/acme/directory/... \
        --eab-kid EAB_KID --eab-hmac-key EAB_HMAC_KEY \
        -d yourdomain.com

Auto-renews on the same 90-day schedule as Let’s Encrypt.

Path 3 — CertCentral API

For enterprise deployments with many certs:

curl -X POST "https://www.digicert.com/services/v2/order/certificate/ssl_plus" \
     -H "X-DC-DEVKEY: your-api-key" \
     -H "Content-Type: application/json" \
     -d @renewal.json

Automate with a script that runs monthly to check expiring certs and re-issue.

Path 4 — CDN Integration (Cloudflare, Fastly, AWS ACM)

If DigiCert certs are used at a CDN edge:

AWS Certificate Manager — can import DigiCert-issued certs but does not renew them; must re-import each cycle
Cloudflare — upload the renewed cert to Cloudflare’s dashboard (SSL/TLS → Edge Certificates → Custom Certificates)
Fastly — upload via TLS management UI or API

Verification

After renewal, verify with the SSL certificate checker:

Correct issuer (DigiCert Inc.)
Fresh issue date
Full chain served (including DigiCert intermediate)
Correct SAN list
Valid to a future date

Common Miss

CAA record restricts DigiCert — check with the CAA record lookup
Wrong CSR (missing SANs, wrong Common Name) — regenerate and reissue
Old cert still cached on CDN — purge or wait for TTL
Missing intermediate cert in the deployed chain — browser trust breaks

Check your deployment with the SSL certificate checker.

Read what an SSL certificate is, check the CAA glossary entry, and read what a CAA record is for issuance restrictions.