--- title: "Glossary" description: "Definitions for CertCentral Services API roles, certificate formats, status values, and product identifiers." source_url: https://dev.digicert.com/certcentral-apis/services-api/glossary.html --- ## Access roles
ID Role Description
1 Administrator Full administrative access, including create divisions and users, manage user access.
2 Limited user Place and manage only their own orders.
3 Finance manager Manage finances, place and manage orders.
4 Manager Manage finances, create and approve requests, manage orders and domains, view and edit users.
5 Standard user Place and manage orders. All changes require approval by a manager or administrator.
## API key roles
Role ID Role name Description
0 N/A No restrictions. Permissions are inherited from access role of the user that is assigned to the key.
100 Orders Limits the key to these actions: Orders, Requests, and Certificates.
101 Orders, Domains, Organizations Limits the key to these actions: Orders, Requests, Organizations, and Domains.
102 View Only Limits key to GET requests only.
103 User Management Limits key to these actions: [Users](https://dev.digicert.com/md/certcentral-apis/services-api/users.md).
## Payment service provider roles
Role name Description
psp_as This role applies to account servicing payment service provider entities. These entities manage payment accounts on behalf of customers, enabling access to the accounts for payment initiation or other services. It typically includes banks or institutions that provide online banking.
psp_pi This role applies to payment initiation service providers entities. These entities initiate payments on behalf of the customer directly from their bank accounts.
psp_ai This role applies to account information service provider entities. These entities offer account aggregation services, consolidating information from multiple payment accounts held by a customer across different financial institutions.
psp_ic This role applies to issuers of card-based payment instruments. These institutions are responsible for issuing credit or debit cards to customers and providing related payment services, including managing card payments and processing transactions.
## Certificate formats > **Info** > > All returned certificates use PEM encoding, which includes header and footer lines.
Format name Content-Type Certificate file extension Description
default application/zip .crt ZIP archive containing individual root, intermediate, and end-entity certificate files.
apache application/zip .crt ZIP archive containing individual intermediate and end-entity certificate files.
default_cer application/zip .cer ZIP archive containing individual root, intermediate, and end-entity certificate files.
cer application/x-pkcs7-certificates .cer Single P7B bundle file containing root, intermediate, and end-entity certificates.
p7b application/x-pkcs7-certificates .p7b Single P7B bundle file containing root, intermediate, and end-entity certificates.
default_pem application/zip .crt ZIP archive containing individual root, intermediate, and end-entity certificate files.
pem_all application/x-pem-file .pem Single PEM bundle containing root, intermediate, and end-entity certificate entries.
pem_nointermediate application/x-pem-file .pem Single PEM file containing only end-entity certificate entry.
pem_noroot application/x-pem-file .pem Single PEM bundle containing intermediate and end-entity certificate entries.
## Certificate profile options Certificate profiles allow you to do more with your certificates. Some options allow you to include an additional field in your certificate, while others allow you to include an additional x.509 extension such as Extended Key Usage (EKU). Some certificate profiles are available by default, while others must be enabled for your account by DigiCert Support. Profiles not enabled by default are not included in the standard DigiCert CertCentral® configuration. To enable a specific certificate profile, please contact your account representative or contact our Support team.
Name Description
data_encipherment Include Data Encipherment key usage extension in a Private SSL/TLS certificate.
non_repudiation Include Non-Repudiation key usage extension in a Private SSL/TLS certificate.
non_repudiation_and_data_enciph Include both Non-Repudiation and Data Encipherment key usage extensions in a Private SSL/TLS certificate.
http_signed_exchange Include CanSignHTTPExchanges extension in DigiCert branded OV or EV SSL/TLS certificate.
delegated_credentials Include DelegationUsage extension in DigiCert branded OV or EV SSL/TLS certificate.
ocsp_must_staple Include OCSP Must-Staple extension in DigiCert branded OV or EV SSL/TLS certificate.
intel_vpro_eku Include Intel vPro EKU (Extended Key Usage) field in DigiCert branded OV SSL/TLS certificate.
kdc_smart_card Include KDC/SmartCardLogon EKU (Extended Key Usage) field in DigiCert branded OV SSL/TLS certificate.
server_auth_only_eku Include only the Server Authentication EKU in an OV, EV, or DV SSL/TLS certificate, X9 PKI for TLS certificates, and Private SSL/TLS certificates.
Note: From October 1, 2025, public TLS certificates will include only the Server Authentication EKU by default. For more information, see Sunsetting the client authentication EKU from DigiCert public TLS certificates.
Certificate type EKU availability
Public TLS Available by default
X9 TLS Available by default
Private SSL Must be turned on by DigiCert support
client_auth_only_eku Include only the Client Authentication EKU in the X9 PKI for TLS and Private SSL/TLS certificates. Use this profile option only when the certificate is intended for client authentication.
Certificate type EKU availability
X9 TLS Available by default
Private SSL Must be turned on by DigiCert support
server_client_auth_eku Include both the Server and the Client Authentication EKU in an OV, EV, or DV SSL/TLS certificate.
Note: From October 1, 2025, DigiCert will stop including the Client Authentication EKU by default in Public TLS certificates. If you want the Client Authentication EKU in the Public TLS certificates after October1, this option must be included in API requests. After May 1, 2026, this profile option will be deprecated.
Certificate type EKU availability
Public TLS Available by default
X9 TLS Available by default
Private SSL Must be turned on by DigiCert support
## Custom order field input types > **Info** > > The *anything* input type is never specified in the metadata response. Instead, the `data_type` parameter is simply omitted, indicating the custom order field uses the *anything* input type.
Type Description
anything No input validation. Uses the input html tag for the form field.
text No input validation. Uses the textarea html tag for the form field.
int Allows only integers as input. Uses the input html tag for the form field.
email_address Allows only a single valid email address as input. Uses the input html tag for the form field.
email_list Allows multiple valid email addresses as input. Does not allow duplicate email addresses. Uses the input html tag for each email address.
## DigiCert currencies
Code Currency
AUD Australian dollar
CHF Swiss franc
GBP British pound sterling
EUR Euro
HKD Hong Kong dollar
JPY Japanese yen
SGD Singapore dollar
SEK Swedish krona
TWD Taiwan dollar
USD US dollar
## Locale codes
Code Language language_id
en English 1
de German 5
es Spanish 2
fr French 3
it Italian 6
ja Japanese 13
kr Korean 14
nl Dutch 17
pt_br Portuguese 4
ru Russian 15
zh_cn Simplified Chinese 11
zh_tw Traditional Chinese 12
## Provisioning methods > **Important** > > If you provision a code signing certificate using `email` or `client_app`, you must have a supported hardware token or a FIPS 140-2+ Level 2 or Common Criteria EAL4+ compliant HSM that supports ECC P-256 or RSA 3072-bit key sizes or larger. If you don't have a compatible hardware token or HSM, you will not be able to install the certificate on your device.
Method Description
email DigiCert emails the certificate to you. Install the certificate on your own supported hardware token or HSM device.
ship_token DigiCert ships a certified hardware token to the address you provide on the order. To activate your certificate, see Set Up Your DigiCert Provided eToken.
client_app Use the DigiCert Hardware Certificate Installer to install the certificate on an existing DigiCert provided, certified token. Learn more:
## CSR requirements
Certificate type CSR
ssl_certificate Required for all orders.
dv_ssl_certificate Required for all orders.
client_certificate Optional for all orders.
code_signing_certificate Required for these uses:

CSRs for code signing certificates must be ECC P-256 or RSA 3072-bit key sizes or larger.
## DCV methods
Method Description
email DigiCert sends a validation email to a supported contact for the domain you are validating. Domain validation emails can be sent to the following contact types:
  • Constructed email addresses such as admin@, administrator@, hostmaster@, postmaster@, and webmaster@. The domain must have a valid MX record.
  • DNS-based email contacts configured in the domain’s DNS TXT or DNS CAA records, that is, an email address specified in a DNS TXT record on the _validation-contactemail subdomain or an email address specified in a DNS CAA record using contactemail.
The recipient must follow the instructions in the validation email to approve the request and complete domain control validation (DCV).

For more information, see Validate domains using email validation methods.
dns-txt-token Create a DNS TXT record for the domain you are validating at the DNS provider that hosts the domain’s DNS records. Add the DigiCert-generated random value, also called the validation token, to the TXT record’s value field. Depending on the relevant CertCentral API endpoint returning the validation token, this value may be returned as dcv_token.token, token, or dcv_random_value. DigiCert checks the domain’s DNS for the presence of that token in the DNS TXT record to complete DCV. DigiCert checks the domain’s DNS for the presence of the TXT record to complete DCV.

For more information, see Validate domains using DNS validation methods or Add and validate a domain using DNS TXT record.
dns-cname-token Create a DNS CNAME record for the domain you are validating at the DNS provider that hosts the domain’s DNS records. Use _dnsauth as the hostname and add the DigiCert-generated random value, also called the validation token, to the CNAME record’s target field in the format {token}.dcv.digicert.com. Depending on the relevant CertCentral API endpoint returning the validation token, this value may be returned as dcv_token.token, token, or dcv_random_value. DigiCert checks the domain’s DNS for the presence of the DNS CNAME record to complete DCV.

For more information, see Validate domains using DNS validation methods or Add and validate a domain using DNS TXT record.
http-token Create a plain-text file on the web server for the fully qualified domain name (FQDN) you are validating at the location http://{domain-name}/.well-known/pki-validation/fileauth.txt. Add the DigiCert-generated random value, also called the validation token, to the file and make it publicly accessible over HTTP. Depending on the relevant CertCentral API endpoint returning the validation token, this value may be returned as dcv_token.token, token, or dcv_random_value. DigiCert retrieves this file to verify domain control and to complete the DCV. This method supports only FQDNs exactly as listed in the certificate request.

For more information, see Validate domains using website validation methods or Add and validate a domain using HTTP Practical Demonstration with unique filename.
http-dynamic
or
http-token-dynamic		 Create a plain-text file on the web server for the FQDN you are validating. Add the DigiCert-generated random value (also called as the validation token) to the file, save it using the DigiCert-provided random filename, and place it at http://{domain-name}/.well-known/pki-validation/{filename}.txt so DigiCert can retrieve it over HTTP. Depending on the relevant CertCentral API endpoint returning the validation token, this value may be returned as dcv_token.token, token, or dcv_random_value. DigiCert checks this file for the presence of the DigiCert-generated random value to verify domain control and to complete the DCV. This method supports only FQDNs exactly as named in the certificate request.

For more information, see Validate domains using website validation methods or Add and validate a domain using HTTP Practical Demonstration with unique filename.
auth-key For a DV certificate order, generate a request token using an AuthKey associated with your CertCentral account. Place the request token in the domain’s DNS TXT record or in a fileauth.txt file on the exact FQDN to be secured, and include use_auth_key=true in the certificate request. DigiCert uses this request token to validate the domain automatically.

For more information, see DV certificate immediate issuance.
token-based Use the token-based DCV method to prove control over the domain by placing a token where DigiCert can find it. Supported token-based DCV methods are dns-txt-token, dns-cname-token, http-token, and DV AuthKeys.

Depending on the method you use, DigiCert checks the domain’s DNS TXT record, DNS CNAME record, or HTTP validation file for the validation token to complete DCV. For method-specific information, refer to the descriptions of dns-txt-token, dns-cname-token, or http-token DCV methods. For DV certificate orders using AuthKeys, generate a request token, place it in the domain’s DNS TXT record or in a fileauth.txt file on the exact FQDN to be secured, and include use_auth_key=true in the certificate request. The token-based DCV method does not support http-token-dynamic or http-dynamic DCV methods. > **Note** > > To enable token-based DCV method for your CertCentral account, please contact your account manager or DigiCert Support.
dns-01 Create a DNS TXT record for the domain you are validating at the DNS provider that hosts the domain’s DNS records. The ACME client places the required DNS validation value under the ACME challenge name for the domain, and DigiCert checks DNS for the presence of that TXT record to complete DCV. Use this challenge for wildcard domains or when HTTP-based validation is not suitable.

For more information, see ACME domain validation challenges.
http-01 Create the ACME HTTP challenge response on the web server for the FQDN you are validating. The ACME client places the challenge content at the standard ACME HTTP path, and DigiCert retrieves it over HTTP on TCP port 80 to complete DCV. This challenge is the easiest to automate, but it does not support wildcard domains and DigiCert does not support using it to validate IP addresses.

For more information, see ACME domain validation challenges.
> **Info** > > Additional info about DCV methods: > - Between the two dns-txt-token and dns-cname-token DCV methods, use the dns-txt-token DCV method as this method is the least vulnerable to industry changes. Use the dns-cname-token DCV method when the domain already has a CNAME record that points to another domain. > - Between the two http-token and http-dynamic DCV methods, use the http-dynamic DCV method if you want to centralize HTTP-based validation. This method supports using 302 redirects for routing validation requests to a central authentication server that hosts all validation files with unique filenames. > - Between the three http-01, dns-01, and cname-delegation ACME DCV methods; use http-01 for the simplest web-server-based ACME automation; dns-01 when you need wildcard support or cannot rely on HTTP validation; and cname-delegation when you want DNS validation to flow through a centralized delegated CNAME target rather than direct TXT updates in each domain’s DNS zone. > - Due to industry-wide changes, the domain revalidation frequency will continue to shorten over time. Starting March 15, 2026, the maximum domain revalidation period will be 199 days. For existing pre-validated domains, the new expiration date must be calculated as the last validation date + 199 days. Domain revalidation frequency will reduce to 99 days from March 15, 2027 and to 9 days from March 15, 2029. For more information, see Domain validation reuse changes in 2026. > - DigiCert ended support for the WHOIS-based DCV email method. To learn more about the end of life for WHOIS-based email, see our knowledge base article, End of Life for WHOIS based email DCV method. > - DV TLS certificate orders do not support the http-dynamic DCV method. > - http-token-static DCV method has been deprecated.

## Hash types
ID Name
sha256 SHA-256
sha384 SHA-384
sha512 SHA-512
sha1 SHA-1
Note: Per industry standards, DigiCert does not support SHA-1 for publicly trusted certificates, including:
  • Public DV and OV/EV TLS/SSL certificates
  • Code signing and EV code signing certificates
  • Document signing certificates
  • Client certificates
  • S/MIME certificates
## Headers Headers are based on the RFC 2616 specification.
Status Description
200 General success response
201 Created: Useful for creation of requests, orders, etc
204 No Content: For successful requests that don't require a response
301 Moved Permanently: Returned in the unlikely event that a URL has changed. Will also return a LOCATION header with new URL. Clients should resubmit this request and submit future requests to this new URL
302 Moved Temporarily: Returned in the unlikely event that a URL has changed temporarily. Will also return a LOCATION header with new URL. Clients should resubmit this single request to this new URL
304 Content not modified: Useful when accessing a URL while waiting for a response. Only used if an IF-NONE-MATCH header was passed
400 General client error
401 Unauthorized: Returned if the page is accessed without a valid API Key
403 User doesn't have permission to perform the requested action
404 Returned if the page doesn't exist or the API doesn't have permission to interact with a particular item
406 If the client doesn't specify a valid acceptable content-type
429 Too many requests. The client has sent too many requests in a given amount of time.
500 Unexpected behavior that the API couldn't recover from
503 The system is currently unavailable
## Order status
Status Description
pending Initial order status.
reissue_pending Reissue was requested and is pending.
rejected Order request was rejected.
processing Order was approved and is being processed.
issued Order was validated and certificate can be downloaded.
revoked Order was revoked.
canceled Order was canceled.
needs_approval A CertCentral admin or manager must approve the order request before DigiCert can process the order.
expired Order has expired.
waiting_pickup For client certificates, the order is ready and DigiCert has emailed the recipient a link to generate the certificate.
## CAA resource record check status
Status Description
VALUE_MISMATCH An error occurred. Make sure you have created a DigiCert CAA for this domain.
DNS_SEC_DS CAA check failed because DNSSEC is enabled. Check your DNS settings. If this check fails again, contact DigiCert Support.*
DNS_SEC_RRSIG CAA check failed because DNSSEC is enabled. Check your DNS settings. If this check fails again, contact DigiCert Support.*
DNS_SEC_VALIDATION_ERROR CAA check failed due to a DNSSEC configuration issue on your domain. Contact your DNS provider to review the domain’s DNSSEC configuration.
DNS_PARSE_ERROR An error occurred on parsing a DNS response for a CAA record. If this check continues to fail, contact DigiCert Support.*
RECORD_UNKNOWN_CRITICAL_TAG A critical error occurred on a CAA check. If this check continues to fail, contact DigiCert Support.*
RECORD_PARSE_ERROR An error occurred on parsing the CAA record. If this check fails again, contact DigiCert Support.*
REQUIRED_PARAMETER_NOT_FOUND An error occurred on a CAA check. If this check fails again, contact DigiCert Support.*
NOT_CALLED_YET We have not yet checked a CAA.
UNKNOWN An error occurred on a CAA check. If this check fails again, contact DigiCert Support.*
* Contact DigiCert Support
## Certificate status (Discovery)
Status
VALID
REVOKED
EXPIRED
UNDETERMINED
## Certificate security rating
Rating
At risk
Not secure
Secure
Very secure
## Server security vulnerabilities
Vulnerability
BEAST
BREACH
CRIME
DROWN
FREEK
Heartbleed
LogJam
POODLE (SSLv3)
POODLE (TLS)
RC4
SWEET32
NO_VULNERABILITY_FOUND
## Payment methods Allowed `payment_method` values when using the API to submit a certificate order request.
Name Description
balance Pay with account balance.
card Pay with a new credit card.
profile Pay with default credit card saved to the account.
## Product identifiers > **Info** > > Actual product list will vary by account. Use the [Get product list](https://dev.digicert.com/md/certcentral-apis/services-api/products/product-list.md) endpoint to see available products.
Name ID Group name Name
ssl_dv_geotrust dv_ssl_certificate GeoTrust Standard DV SSL Certificate
ssl_dv_rapidssl dv_ssl_certificate RapidSSL Standard DV SSL Certificate
ssl_dv_thawte dv_ssl_certificate Thawte SSL123 DV
ssl_dv_ee dv_ssl_certificate Encryption Everywhere DV
wildcard_dv_geotrust dv_ssl_certificate GeoTrust Wildcard DV SSL Certificate
wildcard_dv_rapidssl dv_ssl_certificate RapidSSL Wildcard DV SSL Certificate
cloud_dv_geotrust dv_ssl_certificate GeoTrust Cloud DV
ssl_dv_geotrust_flex dv_ssl_certificate Geotrust DV SSL
ssl_plus ssl_certificate Standard SSL Certificate
ssl_multi_domain ssl_certificate SSL Multi Domain Certificates
ssl_wildcard ssl_certificate Wildcard Certificate
ssl_ev_plus ssl_certificate EV SSL Certificate
ssl_ev_multi_domain ssl_certificate SSL EV Multi Domain Certificate
ssl_cloud_wildcard ssl_certificate SSL Cloud Certificates
ssl_basic ssl-certificate Basic OV
ssl_ev_basic ssl-certificate Basic EV
ssl_thawte_webserver ssl_certificate Thawte SSL Webserver OV
ssl_ev_thawte_webserver ssl_certificate Thawte SSL Webserver EV
ssl_geotrust_truebizid ssl_certificate GeoTrust TrueBusiness ID OV
ssl_ev_geotrust_truebizid ssl_certificate GeoTrust TrueBusiness ID EV
ssl_securesite_pro securesite_ssl_certificate Secure Site Pro SSL
ssl_ev_securesite_pro securesite_ssl_certificate Secure Site Pro EV SSL
ssl_securesite securesite_ssl_certificate Secure Site SSL
ssl_securesite_multi_domain securesite_ssl_certificate Secure Site Multi-Domain SSL
ssl_securesite_wildcard securesite_ssl_certificate Secure Site Wildcard SSL
ssl_ev_securesite securesite_ssl_certificate Secure Site EV SSL
ssl_ev_securesite_multi_domain securesite_ssl_certificate Secure Site EV Multi-Domain SSL
ssl_securesite_flex securesite_ssl_certificate Secure Site OV
ssl_ev_securesite_flex securesite_ssl_certificate Secure Site EV
client_premium client_certificate Client Premium Certificate
client_email_security_plus client_certificate Client Email Security Plus Certificate
client_digital_signature_plus client_certificate Client Digital Signature Plus Certificate
client_authentication_plus client_certificate Client Authentication Plus Certificate
class1_smime client_certificate Class 1 S/Mime Certificate
client_grid_premium grid_certificate GRID Client Premium Certificate
grid_host_ssl grid_certificate GRID Host SSL Plus Certificate
grid_host_ssl_multi_domain grid_certificate GRID Host SSL Multi Domain Certificates
client_grid_robot_fqdn grid_certificate GRID Robot FQDN Certificate
client_grid_robot_name grid_certificate GRID Robot Name Certificate
client_grid_robot_email grid_certificate GRID Robot Email Certificate
private_ssl_plus private_ssl_certificate Private SSL Plus Certificate
private_ssl_wildcard private_ssl_certificate Private SSL Wildcard Certificate
private_ssl_multi_domain private_ssl_certificate Private SSL Multi Domain Certificate
private_ssl_flex private_ssl_certificate Private SSL OV
code_signing code_signing_certificate Code Signing Certificate
code_signing_ev code_signing_certificate EV Code Signing Certificate
document_signing_org_1 document_signing Document Signing Organization (2000) Certificate
document_signing_org_2 document_signing Document Signing Organization (5000) Certificate
vmc_basic verified_mark_certificate Verified Mark Certificate
mark_certificate common_mark_certificate Common Mark Certificate
secure_email_mailbox secure_email_certificate Secure Email for Individual Mailbox
secure_email_sponsor secure_email_certificate Secure Email for Employee
secure_email_organization secure_email_certificate Secure Email for Organization
ds_individual document_signing Document Signing for Individual
ds_org_individual document_signing Document Signing for Employee
ds_org document_signing Document Signing for Organization
eu_eseal european_organization_certificate EU Qualified eSeal Certificate
eu_eseal_psd2 european_organization_certificate EU Qualified eSeal PSD2 Certificate
eu_individual european_individual_certificate EU Qualified Personal Certificate
eu_individual_org european_individual_certificate EU Qualified Personal Organisation Certificate
eu_qwac european_organization_certificate EU Qualified Website Authentication Certificate
eu_qwac_psd2 european_organization_certificate EU Qualified Website Authentication PSD2 Certificate
pkio_qualified_burger pkio_citizen_certificate PKIo Citizen - Signing Certificate
pkio_qualified_organisation_person pkio_personal_organisation_certificate PKIo Personal Organization - Signing Certificate
pkio_qualified_organisation_person_prof pkio_professional_certificate PKIo Professional - Signing Certificate
pkio_qualified_organisation_services pkio_organisation_services_certificate PKIo Qualified eSeal Certificate
## Product types
Type
client_certificate
code_signing_certificate
dv_ssl_certificate
ssl_certificate
verified_mark_certificate
## Server platforms When downloading a certificate, the server platform determines in which format the certificate should be sent. ### TLS/SSL certificates
Platform Certificate format ID
Apache apache 2
Barracuda default 41
Bea Weblogic 7 and older pem_all 29
BEA Weblogic 8 & 9 p7b 42
Cisco default 30
Citrix (Other) pem_noroot 39
Citrix Access Essentials default 46
Citrix Access Gateway 4.x pem_noroot 50
Citrix Access Gateway 5.x and higher apache 58
cPanel apache 43
F5 Big-IP apache 31
F5 FirePass apache 32
IBM HTTP Server default_cer 7
Java Web Server (Javasoft / Sun) p7b 10
Juniper default 33
Lighttpd apache 44
Lotus Domino default 11
Mac OS X Server apache 49
Microsoft Exchange Server 2003 cer 47
Microsoft Exchange Server 2007 cer 36
Microsoft Exchange Server 2010 cer 48
Microsoft Exchange Server 2013 cer 68
Microsoft Exchange Server 2016 cer 71
Microsoft Forefront Unified Access Gateway cer 66
Microsoft IIS 1.x to 4.x default 13
Microsoft IIS 10 cer 70
Microsoft IIS 5 or 6 cer 14
Microsoft IIS 7 cer 40
Microsoft IIS 8 cer 67
Microsoft Live Communications Server 2005 cer 37
Microsoft Lync Server 2010 cer 59
Microsoft Lync Server 2013 cer 69
Microsoft OCS R2 p7b 60
Microsoft Office Communications Server 2007 cer 38
Microsoft Small Business Server 2008 & 2011 default 62
Netscape Enterprise Server default 15
Netscape iPlanet default 9
nginx pem_noroot 45
Novell iChain default 65
Novell NetWare cer 17
Oracle default 18
Qmail pem_all 34
SunOne default 35
Tomcat p7b 24
WebStar default 26
Zeus Web Server default 28
Other default -1
### Code Signing server platforms Use these values for Code Signing certificate orders when your request includes a CSR and the private key and certificate will be stored and installed on a laptop or server instead of a certified hardware token or HSM. > **Warning** > > **Important!** Starting **May 16, 2023**, DigiCert will stop accepting Code Signing (`code_signing`) certificate requests using browser-based key generation and certificate installation or any other process that includes creating a CSR and installing your certificate on a laptop or server. This change affects new, renewal, and reissue code signing certificate requests submitted using the CertCentral UI and the Services API. > > Learn more: > > - DigiCert timeline: Code signing’s new private key storage requirement > - New private key storage requirement for Standard Code Signing certificates
Platform ID
Adobe AIR 52
Apple OS X 53
Microsoft Authenticode 51
Microsoft Office VBA 54
Mozilla 56
Sun Java 55
Other 57
### Code Signing and EV Code Signing hardware platforms Use these values for Code Signing and EV Code Signing certificates when the private key and certificate will be stored and installed on a certified hardware token or HSM.
Platform Device type Supported key sizes ID
SafeNet eToken 5110 FIPS Token ECC P-256 or P-384 20
SafeNet eToken 5110 CC Token
  • RSA 4096
  • ECC P-256
 23
SafeNet eToken 5110+ FIPS Token
  • RSA 4096
  • ECC P-256
 24
SafeNet eToken 5110+ CC (940B) Token ECC P-256 25
Other
Must be a FIPS 140-2 Level 2 or Common Criteria EAL4+ compliant device.		 HSM
  • RSA 3072 or 4096
  • ECC P-256 or P-384
 -1
## Permissions
Permission action
add_domains
create_child_enterprise
create_child_reseller
create_child_retail
create_containers
create_discovery_report
create_discovery_scan
create_discovery_sensor
create_domains
create_guest_keys
create_organizations
create_users
delete_account_scans
delete_scan
edit_container
edit_domains
edit_guest_keys
edit_organizations
edit_users
manage_account_metadata
manage_api_access
manage_discovery_report
manage_discovery_scan
manage_discovery_sensor
manage_finances
manage_guest_keys
manage_ip_access
manage_order_user_access
manage_orders
manage_org_container_assignments
manage_requests
manage_settings
manage_tfa
manage_user_container_assignments
place_orders
review_requests
saml_attribute_mapping
saml_manage_idp
saml_map_idp
saml_organization_mapping
saml_sso
tools_links
update_scan
view_api_access
view_child_account
view_container
view_discovery_report
view_discovery_scan
view_discovery_sensor
view_domains
view_finances
view_guest_keys
view_orders
view_organizations
view_reports
view_scan
view_users
## Subaccount display currencies > **Info** > > When you set up a bill-to-parent subaccount, you can choose to display prices in the subaccount's preferred currency. This is for display only. Parent accounts and subaccounts that DigiCert bills directly always receive invoices in the DigiCert-supported currency associated with the account. For officially supported currencies, see [DigiCert currencies](#digicert-currencies).
Code Currency
ARS Argentine peso
AUD Australian dollar
BRL Brazilian real
GBP British pound sterling
BND Brunei dollar
KHR Cambodia riel
CAD Canadian dollar
CNY Chinese yuan renminbi
COP Colombian peso
EUR Euro
HKD Hong Kong dollar
INR Indian rupee
IDR Indonesia rupiah
JPY Japanese yen
LAK Lao kip
MYR Malaysian ringgit
MXN Mexican peso
MMK Myanmar kyat
NZD New Zealand dollar
NOK Norwegian krone
PHP Philippine peso
RUB Russian ruble
SGD Singapore dollar
ZAR South African rand
KRW South Korean won
SEK Swedish krona
CHF Swiss franc
TWD Taiwan dollar
THB Thailand baht
TRY Turkish lira
USD US dollar
VND Vietnam dong
## Subaccount types
Type Description
retail CertCentral Basic account
enterprise CertCentral Enterprise account
reseller CertCentral Reseller account
managed API only account (no CertCentral UI access)
## User status
Status Description
active Normal user status.
incomplete User has not completed the sign up process.
inactive User profile and settings exist, but user cannot sign in.
## Validation types
Type
cs
ds
ev
ev_cs
grid
ov
private_grid
private_ssl
vmc
Note: The API returns a validation type of vmc for Verified Mark Certificates (VMC) and for organizations included on VMC orders. However, you cannot use the Submit for validation API endpoint to prevalidate an organization for VMC issuance.
smime
## Organization status The `status` property for an organization describes whether the organization is active or inactive in your CertCentral account. - To activate an organization, use the [Activate organization](https://dev.digicert.com/md/certcentral-apis/services-api/organizations/activate-organization.md) endpoint. - To deactiveate an organization, use the [Deactiveate organization](https://dev.digicert.com/md/certcentral-apis/services-api/organizations/deactivate-organization.md) endpoint. > **Info** > > The `status` property for an organization is not related to the validation status for the organization. To get the validation status for an organization, use the [Validation details](https://dev.digicert.com/md/certcentral-apis/services-api/organizations/validation-details.md) endpoint.
Status Description
active Organization is active. This means:
  • You can submit certificate order requests for the organization.
  • The organization appears in the organization selection menu when placing an order from the CertCentral console.
inactive Organization is inactive. This means:
  • You cannot submit new certificate order requests for the organization.
  • The organization does not appear in the organization selection menu when placing an order from the CertCentral console.
## Organization validation statuses
Status Description
pending The validation is pending.
active The validation is active.
rejected DigiCert's validation agents have removed or rejected the validation. To re-submit an organization for validation, use the Submit for validation endpoint.
expired The validation has expired.
## Domain is_active property The `is_active` property for a domain describes whether the domain is active or inactive in your CertCentral account. - To activate a domain, use the [Activate domain](https://dev.digicert.com/md/certcentral-apis/services-api/domains/activate-domain.md) endpoint. - To deactivate a domain, use the [Deactivate domain](https://dev.digicert.com/md/certcentral-apis/services-api/domains/deactivate-domain.md) endpoint. > **Info** > > The `is_active` property for a domain is not related to the validation status for the domain. To get the validation status for a domain, use the [Domain info](https://dev.digicert.com/md/certcentral-apis/services-api/domains/domain-info.md) endpoint.
Description
"is_active": true (active) Domain is active. This means:
  • You can submit certificate order requests for the domain.
  • The domain appears in the list of active certificates on the Certificates > Domains page in the CertCentral console.
"is_active": false (inactive) Domain is inactive. This means:
  • You cannot submit new certificate order requests for the domain.
  • The domain appears in the list of active certificates on the Certificates > Domains page in the CertCentral console.
## Domain validation statuses
Status Description
pending The domain validation is pending.
approved The domain validation is approved and on file.
rejected DigiCert's validation agents have removed or rejected the validation. To re-submit a domain for validation, use the Submit for validation endpoint.
expired The validation has expired.
## Trademark offices and country codes for VMC and CMC logos ### Registered trademarks
Country Country code Trademark office name (source)
Australia au IP Australia
Brazil br National Institute of Industrial Property
Netherlands bx Benelux Organization for Intellectual Property
Canada ca Canadian Intellectual Property Office
Switzerland ch Swiss Federal Institute of Intellectual Property
Germany de German Patent and Trade Mark Office
Denmark dk Danish Patent and Trademark Office
European Union em European Union Intellectual Property Office
Spain es Spanish Patent and Trademark Office
France fr French Patent and Trademark Office
United Kingdom gb Intellectual Property Office
India in Office of the Controller General of Patents, Designs and Trade Marks
Japan jp Japan Patent Office
Republic of Korea (South Korea) kr Korean Intellectual Property Office
New Zealand nz Intellectual Property Office of New Zealand
Sweden se Swedish Intellectual Property Office
United States us United States Patent and Trademark Office
### Government marks
Country Country code
Austria at
Australia au
Belgium be
Bulgaria bg
Brazil br
Canada ca
Switzerland ch
Cyprus cy
Czech Republic cz
Germany de
Denmark dk
Estonia ee
Spain es
European Union eu
Finland fi
France fr
United Kingdom gb
Greece gr
Croatia hr
Hungary hu
Ireland ie
India in
Italy it
Japan jp
Republic of Korea (South Korea) kr
Lithuania lt
Malta mt
Netherlands nl
New Zealand nz
Poland pl
Portugal pt
Romania ro
Sweden se
Slovenia si
Slovakia sk
United States us