DigiCert, Inc. - Experts & Thought Leaders

DigiCert, a pioneer in intelligent trust, announces Secure Releases, new functionality in DigiCert Software Trust Manager that helps organizations assess software risk when a release ships and as new vulnerabilities emerge. Part of the DigiCert ONE platform, it brings together information about supported GitHub releases, their software bills of materials (SBOMs), known vulnerabilities, severity, and security scan results. Teams can identify which versions need attention and use that information in their signing and release workflows. Cryptographic bills of materials Signing confirms who produced software and whether it has been altered, but a component can become vulnerable after the software ships. Finding the affected versions can mean piecing together information from repositories, SBOMs, vulnerability databases, and security scanners. Secure Releases brings that information together by release so teams can see what needs attention and act on it. With Software Trust Manager, including Secure Releases, organizations can: Sign software and cryptographic inventories. Sign software bills of materials (SBOMs) and cryptographic bills of materials (CBOMs) so recipients can verify their source and integrity. See and monitor release risk. View dependencies, SBOMs, vulnerabilities, severity, and supported scan results for each release, and identify new risks as vulnerability information changes. Find and address affected releases. See which releases contain a vulnerable component, alert the teams responsible, and, with Premium, find a version of that component that fixes the vulnerability when one is available. Apply release policies. Set vulnerability and SBOM requirements and, where supported, prevent signing or release when those requirements are not met. Share evidence. Sign security evaluations, VEX statements, SLSA attestations, and SARIF reports for customers and auditors. Vulnerability information changes “Software signing proves where code came from and whether it has been altered, but those assurances do not tell teams whether a release contains a newly discovered vulnerability dependency,” said Deepika Chauhan, Chief Product Officer at DigiCert. “Secure Releases brings those pieces together. By connecting release risk to the same policies that govern signing and delivery, organizations can respond faster when exposure changes and keep software from moving forward when it does not meet their requirements.” Secure Releases is available through Software Trust Manager Essentials, Advanced, and Premium. Essentials provides a point-in-time assessment of release risk. Advanced and Premium add ongoing monitoring of SBOM results by release as vulnerability information changes. Premium also suggests a newer version of a vulnerable component when a fix is available and lets organizations block signing or release if the software does not meet their security requirements.

Global cybersecurity pioneer DigiCert has been the victim of a recent cyberattack. This is a major concern in the cybersecurity industry, as attackers were able to gain access to the issuance of 60 Extended Validation (EV) Code Signing certificates in a clever social engineering scheme. The attack started on April 2 when a sophisticated threat actor reached out to DigiCert’s support system through a Salesforce-based chat system.  The threat actor appeared to be a customer, requested technical assistance, and eventually sent a ZIP file, claiming to be a message from a screenshot of an error. Major containment failure An “.scr (screensaver) file” was found in the archive of the file. On Windows, the system runs or stores .scr as native code. DigiCert’s endpoint defences thwarted the first four attempts, but at the fifth attempt, the attackers were able to get past the security via the support analyst’s workstation, giving them a foothold. DigiCert was able to isolate the first compromised machine (ENDPOINT1) within 24 hours A later investigation found a major containment failure. DigiCert was able to isolate the first compromised machine (ENDPOINT1) within 24 hours, but the attackers had already pivoted to an additional machine (ENDPOINT2). The second compromise was not discovered for 10 days, during which time the hackers were able to move freely about his company’s internal tools, from April 4 to April 14. First compromised machine The hackers took advantage of a “view-as-customer” function as part of the support portal. The developers created this tool for troubleshooting purposes, but it inadvertently provided the codes for the initialization of accepted, but not delivered, EV Code Signing orders. The attackers were able to steal these codes and then: Activate legitimate certificates in their own names. Bypass the rigorous identity verification usually required for EV status. Sign malicious software with “trusted” credentials that bypass Windows SmartScreen and antivirus filters. Stealing sensitive information The stolen certificates have been identified as part of the “Zhong Stealer” malware family by security researchers. This “stealer-RAT” combination is used to steal sensitive information and cryptocurrencies. A single e-crime group tied to the Chinese government appears to be using the stolen certificates known as GoldenEyeDog (APT-Q-27). Since then, DigiCert has canceled all 60 affected certificates, and the team has made emergency security upgrades: Feature Removal: Support staff can no longer view initialization codes. Identity Hardening: MFA teams have tightened the requirements, and the system administrators have disabled Okta FastPass for support portals. IP Blocking: The security team has blacklisted seven attacker-controlled IP addresses. Security professionals are encouraged to immediately update their Certificate Revocation Lists (CRL) and OCSP responders. Users should conduct a security audit of any internal “allow-lists” to make sure that none of the 60 revoked DigiCert certificates are being unwittingly trusted. Digital supply chain This incident is part of a pattern that experts say is becoming more common: Attackers are exploiting the human component of the digital supply chain, which threatens the trust in the internet globally. Upcoming Maintenance DigiCert has a scheduled maintenance window starting Saturday, May 9, 2026: Time: 22:00 – 24:00 MDT (Sunday, May 10, 04:00 – 06:00 UTC). Impact: Signing services (like PrimoSign) and certificate issuance APIs may be temporarily unavailable.

DigiCert, a pioneer in intelligent trust, announces accelerating momentum for DigiCert® Trust Lifecycle Manager (TLM), with annual recurring revenue growing 38% year over year as enterprises increasingly automate certificate management and prepare for shorter certificate lifespans and post-quantum cryptography (PQC). TLM's growth reflects a broader shift in enterprise security. Public TLS certificate maximum validity is on a path to just 47 days in 2029, significantly increasing the certificate management workload. That workload is compounded by the growing number of certificates spread across increasingly complex enterprise environments. Post-quantum transition DigiCert's 2026 Global PKI Research underscores the challenge: only 34% of organizations have a complete, up-to-date inventory of their digital certificates, while 73% are very or extremely concerned about outages caused by expired certificates. “Certificate management has become core infrastructure for the enterprise,” said Deepika Chauhan, Chief Product Officer at DigiCert. “A single missed renewal can trigger a costly outage, and shorter lifespans leave less room for error when managing thousands of certificates. The growth we’re seeing in Trust Lifecycle Manager reflects customers’ urgency to automate renewals, keep critical services running, and build the crypto-agility needed for the post-quantum transition.” Manual certificate management Leading brands around the world are turning to DigiCert Trust Lifecycle Manager to modernise how they manage digital trust, including American Red Cross, Agilent Technologies, Circle K, Hitachi, MediData, MGM Resorts International, Nokia, Schweiserische Mobiliar, and W.L. Gore & Associates. “As certificate lifespans continue to shrink, manual certificate management becomes increasingly challenging at enterprise scale,” said Kenneth Nydegger, Product Owner at Schweizerische Mobiliar, one of Switzerland's pioneer insurers. “DigiCert Trust Lifecycle Manager provides the visibility and automation we need to manage certificates more efficiently and reduce operational risk. At the same time, it helps us prepare for future cryptographic requirements and supports a more agile and sustainable security strategy.” Certificate lifecycle operations “Reliability is fundamental to the digital connections that support Switzerland's healthcare system,” said Michael Stocker, Lead ICT-Infrastructure and ICT-Operations at MediData AG, Switzerland's leading provider of secure healthcare data exchange. “With 24,000 participants exchanging more than 120 million documents through our protected digital data space each year, we need certificate management that can scale without interrupting critical workflows. DigiCert Trust Lifecycle Manager helps us automate those operations and maintain trusted connections across this ecosystem.” Organizations across all industries are using DigiCert TLM to discover certificates and cryptographic assets, centralize visibility, and automate certificate lifecycle operations across increasingly complex environments. Large enterprises with certificate environments exceeding 100,000 certificates are using DigiCert Trust Lifecycle Manager to centralize visibility and automate lifecycle operations. TLM helps reduce manual work, lower outage risk, and keep critical services running as certificate lifespans shrink. As certificate lifespans shorten, that automation becomes increasingly important to keeping services running. Risk of unauthorized enrollment DigiCert continues to expand TLM’s capabilities with new innovations that remove manual work and strengthen security across the certificate lifecycle: Continuous Validation, powered by UltraDNS, automates Domain Control Validation, keeping domains continuously validated and ready for certificate issuance and renewal without recurring manual intervention. Apple Device Attestation verifies hardware-backed device identity before certificates are issued. Combined with DigiCert’s existing Jamf integration, it enables automated certificate enrolment for managed Apple devices while reducing the risk of unauthorized enrollment. Enterprise trust store management extends automation to the roots and intermediate certificates that systems rely on to validate trust. Centralized controls and automated distribution help keep trust stores consistent across enterprise environments, reducing the risk of outages and supporting future cryptographic transitions. Private certificate authorities DigiCert is also expanding the TLM integration ecosystem with technology leaders including BeyondTrust, F5, Fortinet, HashiCorp/IBM, HPE, Imperva, and NetScaler, helping organizations extend certificate automation into the applications, infrastructure, and security platforms where certificates are deployed. DigiCert was named a Leader in the IDC MarketScape: Worldwide Certificate Lifecycle Management 2026 Vendor Assessment. The assessment highlighted TLM's centralized discovery, policy-based governance and end-to-end automation across public and private certificate authorities, along with its ability to help smaller teams automate high-volume certificate environments. Real-world applications “Certificate lifecycle management is a strategic requirement for organizations contending with shorter certificate lifespans, rapidly expanding machine identities, and the transition to post-quantum cryptography,” said Jennifer Glenn, Research Director, IDC. "DigiCert offers capabilities required by enterprises navigating this shift. Trust Lifecycle Manager supports CA-agnostic automation, certificate discovery and governance, and operation across large, hybrid environments. These capabilities address both near-term certificate management needs and the longer-term requirement for enterprise crypto-agility." In September, DigiCert Trust Lifecycle Manager was named a recipient of TMCnet's inaugural 2026 Quantum Computing Product of the Year Award, recognizing products and solutions advancing the quantum computing ecosystem and its real-world applications.