Certificate authority
DigiCert: roots, brands, ACME and the 2024 mass revocation
Details
- CCADB CA owner
- DigiCert
- Country
- US
- Country (CCADB)
- United States of America
- ACME
- Yes
- Free certificates
- No
- Products
- DV OV EV wildcard multi-domain S/MIME code-signing document-signing VMC private-PKI
- Roots
- 20
- Roots trusted for TLS
- Chrome 9 · Mozilla 7 · Apple 15 · Microsoft 20
- Intermediates under its roots
- 821 (518 valid)
- Auditor
- BDO International Limited
- CAA
digicert.com
DigiCert is a major commercial certificate authority and the company behind the GeoTrust, Thawte and RapidSSL brands. It sells DV, OV and EV TLS certificates plus S/MIME, code signing, document signing and Verified Mark Certificates, and supports automation through ACME, but it has no free tier.
Owner and headquarters
DigiCert was founded in 2003 and is headquartered in Lehi, Utah, in the United States. Its history page lists two big acquisitions: Symantec's Website Security business in 2017, after browsers distrusted Symantec's roots, and QuoVadis, a qualified trust service provider in the EU and Switzerland, in 2019. The 2017 deal closed on 2017-10-31 and brought the GeoTrust, Thawte and RapidSSL brands to DigiCert.
Root certificates
As of November 2026, CCADB lists 20 roots under DigiCert, more than any other CA owner. Trusted for TLS by Chrome, Mozilla, Apple and Microsoft are DigiCert Global Root G2 and G3, Assured ID Root G2 and G3, TLS RSA4096 Root G5, TLS ECC P384 Root G5 and QuoVadis Root CA 2 G3. Chrome has removed the 2006 roots (DigiCert Global Root CA, Assured ID Root CA, High Assurance EV Root CA) and several QuoVadis roots, while the other stores still include them. Newer roots such as the QuoVadis TLS G4 roots are, so far, only in Microsoft's store. Many other issuers chain to DigiCert Global Root G2; for example, Apple's own EV server CA does.
Certificate products
DigiCert covers the full range: DV, OV and EV TLS certificates, wildcard and multi-domain variants, S/MIME, code signing, document signing, VMC for BIMI, and private PKI through DigiCert ONE and CertCentral.
ACME support
DigiCert supports ACME for paid certificates through its CertCentral platform, using External Account Binding credentials tied to your account. Standard clients like certbot and acme.sh work.
Free certificates
DigiCert doesn't offer free publicly trusted TLS certificates.
Notable incidents
In late July 2024 DigiCert reported that, since a 2019 system change, some domain validations using a CNAME record had a random value without the required underscore prefix (Bugzilla 1910322). It revoked 83,267 affected certificates; because some customers couldn't replace them within 24 hours, the revocations finished on 2024-08-03, which DigiCert reported as a separate delayed-revocation incident (Bugzilla 1910805). Since then the CA/B Forum has required every CA to keep a tested mass revocation plan under SC-089.
CAA records
The CCADB lists 22 CAA issuer domain(s) recognized by the currently valid intermediate certificates of DigiCert. One issue record with any of them lets DigiCert issue for your domain. Domains that contain the CA's name come first, the rest by how many valid intermediates recognize them.
Copy-ready record(s) for the first 3 domain(s):
example.com. CAA 0 issue "digicert.com"
example.com. CAA 0 issue "digicert.ne.jp"
example.com. CAA 0 issue "www.digicert.com"| Domain | Valid intermediates |
|---|---|
digicert.com | 590 |
digicert.ne.jp | 582 |
www.digicert.com | 582 |
amazon.com | 598 |
amazonaws.com | 598 |
amazontrust.com | 598 |
awstrust.com | 598 |
digitalcertvalidation.com | 582 |
geotrust.com | 582 |
quovadisglobal.com | 582 |
rapidssl.com | 582 |
symantec.com | 582 |
thawte.com | 582 |
1and1.digitalcertvalidation.com | 582 |
cybertrust.ne.jp | 582 |
intermediatecertificate.digitalcertvalidation.com | 582 |
stratossl.digitalcertvalidation.com | 582 |
volusion.digitalcertvalidation.com | 582 |
amazonaws.eu | 16 |
amazontrustservices.eu | 16 |
amznts.eu | 16 |
aws.amazon.com | 16 |
For issuewild, iodef or DNS-provider formats, use the CAA record generator: CAA Generator
Root certificates (CCADB)
DigiCert has 20 root certificate(s) in the CCADB TLS report. Together they have signed 821 intermediate CA certificates, 518 of them still valid.
Roots this CA owner has in the CCADB TLS Server Authentication report, with current status in each root store.
- trusted for TLS
- included with limits (NotBefore / no TLS bit)
- removed or blocked
- not included
| Root certificate | Key | Expires | Ch | Mo | Ap | MS | Intermediates |
|---|---|---|---|---|---|---|---|
| DigiCert Assured ID Root CA | RSA 2048 | 2031-11-10 | Removed | Included | Included | Included | 64 (28) |
| DigiCert Assured ID Root G2 | RSA 2048 | 2038-01-15 | Included | Included | Included | Included | 163 (139) |
| DigiCert Assured ID Root G3 | ECDSA P-384 | 2038-01-15 | Included | Included | Included | Included | 6 (6) |
| DigiCert ECC P384 Root G5 | ECDSA P-384 | 2046-01-14 | Not included | Not included | Not included | Included | 2 (2) |
| DigiCert Global Root CA | RSA 2048 | 2031-11-10 | Removed | Included | Included | Included | 70 (53) |
| DigiCert Global Root G2 | RSA 2048 | 2038-01-15 | Included | Included | Included | Included | 100 (57) |
| DigiCert Global Root G3 | ECDSA P-384 | 2038-01-15 | Included | Included | Included | Included | 79 (41) |
| DigiCert High Assurance EV Root CA | RSA 2048 | 2031-11-10 | Removed | Included | Included | Included | 94 (65) |
| DigiCert RSA4096 Root G5 | RSA 4096 | 2046-01-14 | Not included | Not included | Not included | Included | 2 (2) |
| DigiCert TLS ECC P384 Root G5 | ECDSA P-384 | 2046-01-14 | Included | Included | Included | Included | 20 (20) |
| DigiCert TLS RSA4096 Root G5 | RSA 4096 | 2046-01-14 | Included | Included | Included | Included | 21 (20) |
| DigiCert Trusted Root G4 | RSA 4096 | 2038-01-15 | Included | Included | Included | Included | 32 (32) |
| QuoVadis Root CA 1 G3 | RSA 4096 | 2042-01-12 | Removed | Included | Included | Included | 51 (36) |
| QuoVadis Root CA 2 | RSA 4096 | 2031-11-24 | Removed | Included | Included | Included | 32 (2) |
| QuoVadis Root CA 2 G3 | RSA 4096 | 2042-01-12 | Included | Included | Included | Included | 30 (9) |
| QuoVadis Root CA 3 | RSA 4096 | 2031-11-24 | Removed | Included | Included | Included | 35 (2) |
| QuoVadis Root CA 3 G3 | RSA 4096 | 2042-01-12 | Included | Included | Included | Included | 11 (1) |
| QuoVadis TLS ECC P384 Root G4 | ECDSA P-384 | 2048-03-09 | Not included | Not included | Not included | Included | 2 (1) |
| QuoVadis TLS RSA 4096 Root G4 | RSA 4096 | 2048-03-09 | Not included | Not included | Not included | Included | 1 (1) |
| Verizon Global Root CA | RSA 2048 | 2034-07-30 | Not included | Not included | Not included | Included | 6 (1) |
Valid intermediate CAs operated by DigiCert under roots that other CAs own (CCADB; number of valid intermediates in brackets):
Audits
Audit data the CCADB records for the TLS roots of DigiCert. Auditor(s): BDO International Limited. The most recent audit period ended on 2025-08-31.
| Audit | Scheme | Period | Statement | Report |
|---|---|---|---|---|
| Standard audit | WebTrust | 2024-09-01 – 2025-08-31 | 2025-11-21 | cpacanada.ca |
| Network security | WebTrust | 2024-09-01 – 2025-08-31 | 2025-11-21 | cpacanada.ca |
| TLS Baseline Requirements | WebTrust | 2024-09-01 – 2025-08-31 | 2025-11-21 | cpacanada.ca |
| TLS EV Guidelines | WebTrust | 2024-09-01 – 2025-08-31 | 2025-11-21 | cpacanada.ca |
CP/CPS documents
Certificate Policy and Certification Practice Statement links that DigiCert has disclosed in the CCADB for its TLS roots, with effective dates:
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-public-trust-cp-cps-v7-09.pdf (effective 2026-09-03)
- CP/CPS: https://www.digicert.com/content/dam/digicert/pdfs/legal/digicert-europe-cpcps-v6-11.pdf (effective 2026-10-14)
- Document repository: https://www.digicert.com/legal-repository/
Report a certificate problem
To report a mis-issued certificate, a compromised private key or other abuse, use the channels DigiCert lists in the CCADB (replace [at] and [dot] in addresses):
revoke[at]digicert[dot]com
Incident reports
CAs in Mozilla's root program file compliance incident reports in Mozilla's Bugzilla (product CA Program, component CA Certificate Compliance). This search lists the bugs whose title contains the words “DigiCert”:
FAQ
Are GeoTrust, Thawte and RapidSSL separate CAs?
No. They are DigiCert brands, issued from DigiCert-operated hierarchies; the CCADB lists no separate CA owner for them.
What CAA record allows DigiCert to issue certificates?
Publish example.com. CAA 0 issue "digicert.com". The CCADB lists 22 recognized domain(s) for DigiCert: digicert.com, digicert.ne.jp, www.digicert.com, amazon.com, amazonaws.com, amazontrust.com, awstrust.com, digitalcertvalidation.com….
Who audits DigiCert?
BDO International Limited, according to the CCADB. The latest TLS Baseline Requirements audit (WebTrust) covers 2024-09-01 to 2025-08-31; the statement is dated 2025-11-21.
How do I report a problem certificate to DigiCert?
Use the channel(s) listed in the CCADB: revoke[at]digicert[dot]com.