DV certificate immediate issuance

In order to take advantage of immediate issuance, you must complete these steps before submitting your DV certificate order:

If all these steps are complete when you submit your DV certificate order, we immediately issue your DV certificate and return it in the response body. If any of these steps are skipped, immediate issuance cannot happen.

First, you need to create an AuthKey for your CertCentral account. You will use this key to generate a request token for proving control over the domain. Additionally, you can create multiple AuthKeys with a defined validity period, often referred to as Time-to-Live (TTL) AuthKeys. It is possible to create multiple such AuthKeys, with a minimum validity of 1 day and no upper limit on the maximum duration. You can create an AuthKey or multiple AuthKeys with a POST to the Create AuthKey endpoint.

A successful POST to this endpoint returns a 200 OK HTTP response. The response body includes two key pieces of information:

curl -X POST \
  https://www.digicert.com/services/v2/account/auth-key \
  -H 'Content-Type: application/json' \
  -H 'X-DC-DEVKEY: {{api_key}}'

{
  "auth_key_id": "{{auth_key_id}}",
  "auth_key": "{{auth_key}}"
}

{
  "errors": [
    {
      "code": "auth_key_exists_for_account",
      "message": "An error occurred while processing your request."
    }
  ]
}

Once you have the AuthKey for your account, the next step is to create a CSR for the certificate order. You'll need the CSR to generate a request token. Make sure to generate your CSR on the server where the certificate will be installed.

The timestamp determines the starting date and time (UTC) of the 30-day validity period for the request token. When creating a timestamp, make sure the resulting validity window coincides with when you will submit your DV certificate order. If your order is submitted before or after the validity window, immediate issuance cannot happen.

After determining when the request token's validity window should start, you need to format the timestamp as shown below:

yyyyMMddhhmmss

For example, October 21, 2019 1:30:12 PM would become 20191021133012.

Now that you have your AuthKey, CSR, and timestamp, you're ready to generate a request token used to prove control over the domain. This request token allows you to set up your domain's DNS TXT record or fileauth.txt file before placing a certificate order.

# Declare AuthKey, CSR, and timestamp
auth_key = 'certcentral_account_auth_key'
csr = 'pem_formatted_csr'
timestamp = 'yyyyMMddhhmmss'

# Construct secret to be hashed
secret = timestamp + csr

# Hash secret using HMAC-SHA256 and auth_key
hash = hmac.sha256(secret, auth_key)

# Convert hexadecimal hash to decimal
decimal_hash = convertToBase10(hash)

# Convert decimal_hash to base36
base36_hash = convertToBase36(decimal_hash)

# If base36_hash length is < 50, prepend with zeros
valid_hash = base36_hash.padStart(50, '0')

# Construct final request token
request_token = timestamp + valid_hash

For DV certificate immediate issuance, you must place the request token in one of these places before you order the certificate:

Once the request token is placed, you can submit your DV certificate order.

Once you've placed the request token, you're ready to submit your DV certificate order request. This is done with a POST to the Order DV SSL endpoint.

In the JSON request body:

A successful POST to this endpoint returns a 201 Created HTTP response code. If all immediate issuance requirements are met, the full certificate chain is returned in the response body.

curl -X POST \
  'https://www.digicert.com/services/v2/order/certificate/{{dv_ssl_certificate_id}}' \
  -H 'Content-Type: application/json' \
  -H 'X-DC-DEVKEY: {{api_key}}' \
  -d '{
    "certificate": {
        "common_name": "example.com",
        "csr": "<csr>",
        "server_platform": {
            "id": 2
        }
    },
    "order_validity": {
        "years": 1
    },
    "dcv_method": "dns-txt-token",
    "use_auth_key": true,
    "auth_key_id": "{auth_key_id}",    
    "skip_approval": true
}'

curl -X POST \
  'https://www.digicert.com/services/v2/order/certificate/{{dv_ssl_certificate_id}}' \
  -H 'Content-Type: application/json' \
  -H 'X-DC-DEVKEY: {{api_key}}' \
  -d '{
    "certificate": {
        "common_name": "example.com",
        "csr": "<csr>",
        "server_platform": {
            "id": 2
        }
    },
    "order_validity": {
        "years": 1
    },
    "dcv_method": "http-token",
    "use_auth_key": true,
    "auth_key_id": "{auth_key_id}",    
    "skip_approval": true
}'

curl -X POST \
  'https://www.digicert.com/services/v2/order/certificate/{{dv_ssl_certificate_id}}' \
  -H 'Content-Type: application/json' \
  -H 'X-DC-DEVKEY: {{api_key}}' \
  -d '{
    "certificate": {
        "common_name": "example.com",
        "csr": "<csr>",
        "server_platform": {
            "id": 2
        }
    },
    "order_validity": {
        "years": 1
    },
    "dcv_method": "token-based",
    "use_auth_key": true,
    "auth_key_id": "{auth_key_id}",    
    "skip_approval": true
}'

{
  "id": 112339,
  "certificate_id": 132345,
  "certificate_chain": [
    {
      "subject_common_name": "example.com",
      "pem": "<pem_certificate>"
    },
    {
      "subject_common_name": "DigiCert SHA2 Secure Server CA",
      "pem": "<pem_certificate>"
    },
    {
      "subject_common_name": "DigiCert Global Root CA",
      "pem": "<pem_certificate>"
    }
  ]
}