Reissue certificate

POST https://www.digicert.com/services/v2/order/certificate/{{order_id}}/reissue

Use this endpoint to reissue a certificate. A certificate reissue replaces the existing certificate with a new one that has different information, such as a different common name, CSR, or signature hash.

Notice

When you reissue a certificate for a Multi-year Plan, you can set a new expiration date for the reissued certificate. For more information, see Multi-year plans.

Reissue Code Signing and EV Code Signing certificates

When reissuing a Code Signing or EV Code Signing certificate, you can choose a provisioning method for the reissued certificate by including the cs_provisioning_method parameter in your request payload.

If you submit a reissue request without providing a cs_provisioning_method value:

By default, DigiCert reissues the certificate using the current provisioning method for the order. To get the current provisioning method for an order, check the value of the cs_provisioning_method parameter on the Order info API response.
If the provisioning method stored on the order is not currently enabled in your account preferences, DigiCert reissues the certificate using the default provisioning method from your account preferences. Then, the provisioning method stored on the order is updated to match the provisioning method used to reissue the certificate.

Example requests and responses

Example 1. cURL

curl -X POST \
  'https://www.digicert.com/services/v2/order/certificate/{{order_id}}/reissue' \
  -H 'Content-Type: application/json' \
  -H 'X-DC-DEVKEY: {{api_key}}' \
  -d '{
  "certificate": {
    "common_name": "example.com",
    "dns_names": [
        "sub.example.com"
    ],
    "csr": "<csr>",
    "server_platform": {
      "id": 2
    },
    "signature_hash": "sha256"
  }
}'

Example 2. Python

import requests

url = "https://www.digicert.com/services/v2/order/certificate/{{order_id}}/reissue"

payload = "{\n  \"certificate\": {\n    \"common_name\": \"example.com\",\n    \"dns_names\": [\n        \"sub.example.com\"\n    ],\n    \"csr\": \"<csr>\",\n    \"server_platform\": {\n      \"id\": 2\n    },\n    \"signature_hash\": \"sha256\"\n  }\n}"
headers = {
    'X-DC-DEVKEY': "{{api_key}}",
    'Content-Type': "application/json"
    }

response = requests.request("POST", url, data=payload, headers=headers)

print(response.text)

Example 3. Go

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io/ioutil"
)

func main() {

	url := "https://www.digicert.com/services/v2/order/certificate/{{order_id}}/reissue"

	payload := strings.NewReader("{\n  \"certificate\": {\n    \"common_name\": \"example.com\",\n    \"dns_names\": [\n        \"sub.example.com\"\n    ],\n    \"csr\": \"<csr>\",\n    \"server_platform\": {\n      \"id\": 2\n    },\n    \"signature_hash\": \"sha256\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-DC-DEVKEY", "{{api_key}}")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := ioutil.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}

Example 4. NodeJS

var request = require("request");

var options = { method: 'POST',
  url: 'https://www.digicert.com/services/v2/order/certificate/{{order_id}}/reissue',
  headers: 
   { 'Content-Type': 'application/json',
     'X-DC-DEVKEY': '{{api_key}}' },
  body: 
   { certificate: 
      { common_name: 'example.com',
        dns_names: [ 'sub.example.com' ],
        csr: '<csr>',
        server_platform: { id: 2 },
        signature_hash: 'sha256' } },
  json: true };

request(options, function (error, response, body) {
  if (error) throw new Error(error);

  console.log(body);
});

Request parameters

Name	Req/Opt	Type	Description
certificate	required	object	Details about the certificate.
.. common_name	conditional^*	string	Domain to be secured. ^*Note: The `common_name` request parameter is required on reissue requests for public and private TLS/SSL certificates. However, you should omit the `common_name` parameter from reissue requests for Verified Mark Certificates (VMC), Code Signing certificates, EV Code Signing certificates, and Document Signing certificates.
.. dns_names	optional	array	Additional domains to be secured.
.. csr	conditional	string	Certificate signing request (CSR). Usage depends on certificate type. TLS/SSL certificate reissues: A CSR is required when reissuing TLS/SSL certificates. Code Signing and EV Code Signing certificate reissues: A CSR is required when reissuing Code Signing or EV Code Signing certificates that will be installed on HSMs (`cs_provisioning_method` is `email`). The CSR must use a key size your hardware supports. If the provisioning method is `ship_token` or `client_app`, omit the CSR from your request.
.. server_platform	conditional	object	Server platform type.
.. .. id	required	int	Server platform ID. Usage depends on certificate type. TLS/SSL certificate reissues: Providing a new `server_platform.id` is optional. For allowed values, see Glossary – TLS/SSL certificates. Code Signing and EV Code Signing certificate reissues: For allowed values, see Glossary – Code Signing and EV Code Signing hardware platforms. Usage requirements depend on provisioning method (`cs_provisioning_method`). `ship_token`: `server_platform.id` is optional and has no impact on the token type DigiCert ships. If not provided, defaults to `23`. `email`: `server_platform.id` is optional. If not provided, defaults to `-1`. Note: When the provisioning method is `email`, the CSR in your request must use a key size your hardware supports. `client_app`: `server_platform.id` is required.
.. cert_validity	optional	object	Defines the validity period of the reissued certificate. If not provided, the validity period for the reissued certificate defaults to the time remaining in the Multi-year Plan or the maximum certificate validity period defined by CA/B Forum baseline requirements, whichever is shorter. This object is ignored for reissues that are not associated with a Multi-year Plan.
.. .. years	optional	int	Number of years the certificate is valid after it is issued. Can be replaced with `cert_validity.days` or `cert_validity.custom_expiration_date`. Allowed value: `1`
.. .. days	optional	int	Number of days the certificate is valid after it is issued. Overrides `cert_validity.years`. Max: `397`
.. .. custom_expiration_date	optional	string	A custom expiration date for the certificate. Overrides `cert_validity.days` and `cert_validity.years`. Format: `dd MMM YYYY` (for example, `"09 JUN 2021"`) Range: Must be within 397 days of the date you request the certificate.
.. signature_hash	required	string	Hash algorithm used to signing the certificate.
.. profile_option	optional	string	Certificate profile option for the reissued certificate. Allowed values: See Glossary – Certificate profile options
.. ca_cert_id	optional	string	ID of the intermediate certificate authority (ICA) certificate to select as the issuing certificate. To get the `ca_cert_id` value for an ICA, use the Product list endpoint. Account administrators can customize the default and allowed ICAs for each product at the container or user role level. If you do not provide a value for this parameter, we issue the certificate using the default ICA. If you provide the `ca_cert_id` value for an ICA that is not allowed, the request returns an error^. To see the custom ICA settings for each product, use the Product limits endpoint. ^This parameter is ignored if the option for ICA selection is not enabled for your account. For more information, see ICA certificate chain selection.
dcv_method	optional	string	For TLS/SSL reissues, DCV method to use when verifying domain control. See Glossary – DCV methods.
comments	optional	string	Message about the reissue.
skip_approval	optional	bool	Specify if the order should skip the approval step and be immediately submitted for validation and issued when complete. Default:`false`
certificate_dcv_scope	optional	string	Domain validation scope for domains on the order. Domain validation scope determines the specific domains that you must validate before DigiCert can issue your certificate. Allowed values: `base_domain`: Validate each domain and subdomain in the request at the base domain level (for example, example.com). `fqdn`: Validate each domain and subdomain included in the order exactly as named in the request. When using `fqdn`: If a domain is a subdomain of another domain included on the order, complete the DCV check for the higher-level domain. For OV and EV certificates only, if a higher-level domain exists in the account with an active validation, we validate the domain under the scope of the existing domain. Default: This parameter overrides the domain validation scope settings for your CertCentral account. If you omit this parameter, the account setting is used.
use_auth_key	optional	bool	Use this parameter to complete DCV checks for new domains on a DV TLS/SSL reissue using an AuthKey request token. If `true`, when you submit the order request, DigiCert checks the DNS records for an AuthKey request token to complete domain control validation. To learn more about using AuthKey request tokens, see DV certificate immediate issuance. Default:`false` Note: For Encryption Everywhere DV certificates, this parameter is ignored. When requesting an Encryption Everywhere certificate, if an AuthKey exists for the account, DigiCert always checks the DNS records for an AuthKey request token. If no AuthKey exists for the account, or if DigiCert doesn't find a valid AuthKey request token for one or more domains on the order, the API returns an error.
cs_provisioning_method	optional	string	For Code Signing or EV Code Signing reissues, provisioning method for the certificate. Optional for both Code Signing and EV Code Signing certificate reissues. If omitted: By default, DigiCert reissues the certificate using the current provisioning method for the order. To get the current provisioning method for an order, check the value of the `cs_provisioning_method` parameter on the Order info API response. If the provisioning method stored on the order is not currently enabled in your account preferences, DigiCert reissues the certificate using the default provisioning method from your account preferences. Then, the provisioning method stored on the order is updated to match the provisioning method used to reissue the certificate. Allowed values: `ship_token`: DigiCert ships you a hardware token with instructions to activate your certificate (see Set Up Your DigiCert Provided eToken). To provide your shipping address, use the `ship_info` object. Otherwise, DigiCert uses the default shipping address from your CertCentral account settings. `email`: DigiCert sends you the certificate to install on your own Common Criteria EAL4+ standard or FIPS 140-2 level 2 HSM. If you don't have a compatible HSM, select a different provisioning method. A CSR is required when using this provisioning method^*. `client_app`: Install the certificate on a supported secure token you already own. To identify your device, use the `certificate.server_platform` object.
ship_info	optional	object	For Code Signing or EV Code Signing reissues with a `cs_provisioning_method` of `ship_token`, specify the shipping address for the hardware token. Optional for both Code Signing and EV Code Signing certificates. For orders that omit the `ship_info` object, DigiCert uses the default token shipping address from your CertCentral account settings.
.. name	required	string	Name of the recipient.
.. addr1	required	string	Shipping address for the token.
.. addr2	optional	string	Secondary address field.
.. city	required	string	Shipping city.
.. state	required	string	Shipping state
.. zip	required	string	Shipping postal code.
.. country	required	string	Shipping country.
.. method	required	string	Shipping priority for the token. Allowed values:`STANDARD`, `EXPEDITED` (incurs added cost)

Response parameters

Name	Type	Description
id	int	Order ID.
certificate_id	int	Certificate ID. Only returned if `skip_approval` is `true`.
dcv_random_value	string	Random value used for domain control validation (DCV). Use this token to complete the DCV check for any domain submitted for validation with the order. Only returned when the DCV method is `dns-txt-token`, `dns-cname-token`, or `http-token`.
requests	array	List of requests.
.. id	int	Request ID.

In this section: