The domain locking by DigiCert
DigiCert introduces the domain locking. You'll access the option on the certificates ordered via a TBS Certificate Center.
What is domain lock ?
This functionality allows to define the accounts authorizes to order certificates for your domains. Once the domain lock is activated, only TBS INTERNET will be able to order certificates to DigiCert for the affected domains or sub-domains.
It is a security measure to enable a full control regarding who's authorized to order certificates for each one of your domains.
For which products?
All server certificates issued by the group meaning: DigiCert, Thawte, Geotrust and RapidSSL.
How to activate domain lock?
Domain lock relies on the CAA DNS record that allows the owner of a domain name to authorize (and therefore also prohibit) one or more certification authorities to issue certificates for the domain concerned.
Example of CAA records allowing Sectigo and DigiCert to issue certificates for the domain "domain.com" :
domain.com. CAA 0 issue "sectigo.com" domain.com. CAA 0 issue "digicert.com"
To enable domain lock the ID of the authorized account must be added in the CAA record:
domain.com. CAA 0 issue "digicert.com; account=xxxxxxxxxxx"
How to retrieve this value?
To do so, go on your certificate status page. Click on the "Activate / deactivate domain lock" button of the "Domain lock" area.
A popup opens displaying each domain / sub-domain of the certificate. Click on "Activate domain lock" to get the CAA value for the selected domain. Once the record is in place click again on this button to request DigiCert to check its presence and to lock the domain.
How to unlock a domain?
Deleting the CAA record is not enough to unlock a domain. You'll have to submit a request to the authority. To do so, go on your certificate status page.
Click on the "Activate / deactivate domain lock" button of the "Domain lock" area.
Then click on the "Deactivate domain lock" button.
