PKI and TLS · Checked 5 November 2026, 03:06 UTC.
DigiCert’s November 4, 2026 CertCentral update (Europe: October 27) affects orders/renewals for ICA-enabled products accepting CSRs and supporting both RSA and ECC. It excludes reissues, duplicates and products without ICA selection.
Default and specific chains behave differently
“DigiCert default” now follows the CSR’s key type. Specific chains persist despite mismatch; web warnings allow submission. API requests use ca_cert_id if supplied, otherwise the product default. Mixed chains stay supported.
An intermediate certificate authority (ICA) links the server certificate to a root. Keep the server’s key type, the issuing CA’s key type and the client’s trust requirements separate when reviewing an issuance workflow.
Inspect the product used by the integration
The Product info API returns settings in the context of the requesting user and container. Its allowed_ca_certs list identifies the ICAs that caller may select for supported public DV, OV and EV products when ICA selection is enabled. An administrator’s view is therefore not a substitute for checking the integration’s own context.
The order API documentation also distinguishes an omitted ca_cert_id from an explicit value. With ICA selection enabled, a value outside the allowed set returns an error. Record both the request and the product configuration when explaining why a chain was chosen.
A practical review
Suggested operational checks:
- Record the product, requesting identity, container and whether the request supplies an ICA identifier. Keep API keys out of tickets and screenshots.
- Write down the chain you expect before a planned, authorized order or renewal. Check the issued certificate and chain against that expectation.
- Investigate any warning before proceeding.
- Validate the deployed chain with representative clients. Record the result separately from the successful certificate order.
We reviewed DigiCert’s public documentation; we did not issue or deploy a certificate for this article. The useful review record is the request context, expected chain, actual chain and client test result.