DigiCert

Profile narrative

DigiCert operates as a certificate authority that issues digital certificates for securing online communications. Its core offerings include TLS/SSL certificates for websites, code‑signing certificates for software publishers, and extended validation (EV) certificates that provide the highest level of identity assurance. The company also provides public key infrastructure (PKI) management tools, certificate lifecycle automation, and services related to Certificate Transparency (CT) logs. These products are used by enterprises, developers, and organizations that need to authenticate servers, sign executables, and protect data in transit. DigiCert’s certificates are trusted by major operating systems and browsers because its root certificates are pre‑installed in those trust stores.

A distinguishing attribute of DigiCert is its focus on high‑assurance solutions, particularly EV code‑signing orders that require rigorous validation before a certificate is issued. The firm plays an active role in the Certificate Transparency ecosystem, maintaining signing keys for CT logs that help detect misissued certificates. Its support infrastructure includes a customer chat portal that, in April 2026, was compromised through a malicious payload, leading to unauthorized access to internal support systems. The breach allowed attackers to obtain initialization codes for approved EV code‑signing orders, which were later used to sign the Zhong Stealer malware before the certificates were revoked. In addition, DigiCert’s root certificates were mistakenly flagged as malware by Microsoft Defender in the same incident, a false positive that was corrected in a later security‑intelligence update. Earlier, in May 2020, attackers exploited critical SaltStack vulnerabilities to gain unauthorized access to DigiCert’s Certificate Transparency Log 2 signing key, prompting the log to be placed in read‑only mode as a precaution. Despite the key exposure, the company reported no evidence of malicious use and confirmed that certificate operations remained unaffected due to environmental separation.

DigiCert is headquartered in the United States of America, which serves as the base for its global operations. The organization functions as an independent certificate authority that is not described as a subsidiary of another entity in the available information. Its position in the market is defined by its long‑standing reputation for trustworthiness and its participation in standards‑setting bodies that shape PKI and CT practices.

Incidents

2 incidents linked to this organisation.