DigiCert
The big-league CA every enterprise has heard of, with a price tag that matches. Petra has bought from them for kernel-mode signing and EV certs that have to live behind a particular procurement firewall, and not much else, since 2017.
01Product catalog & prices
Q2 2026 · 1-yr SKU pricing via resellerDigiCert's catalog is among the broadest in the industry, but the price is set as if every cert is a kernel-mode SKU. The eight cards below are the SKUs I would actually consider; everything else is for procurement reasons that override price-per-cert.
DigiCert EV Code Signing + KSP
- Microsoft attested for kernel-mode
- KeyLocker cloud signing included
- Token billed +$120
DigiCert Code Signing
- For Authenticode reputation building
- Microsoft kernel-mode attestation
- Token billed +$120
DigiCert Secure Site EV
- Reissues unlimited
- $1.75M warranty
- Wildcard not available
DigiCert Secure Site Pro
- $1.5M warranty (excessive for most)
- CertCentral console included
- WAF + scan add-ons
DigiCert Wildcard Plus
- Unlimited subdomains
- Reissues unlimited
- Auto-renew via API
DigiCert Multi-Domain SSL
- $25 per additional SAN above the base 4
- Reissue + add SANs anytime
- Console-managed bulk renewals
DigiCert Document Signing (Adobe AATL)
- AATL trust list
- Three-year validity
- Token included
DigiCert Email Security Plus
- Encryption + signing
- Outlook + Gmail compatible
- Bulk org pricing available
02Validation process
EV SSL · DUNS-listed companyDigiCert's EV validation is the slowest of the four big CAs I work with, mostly because they own the queue. The flow itself is fine; you wait because you wait.
-
Day 0
Order placed via reseller; documents attached. Articles of incorporation, DUNS, authorisation letter, IT contact phone number, billing address.
-
Day 1
Order entered into the validation queue. Auto-confirmation email arrives within an hour. Nothing actually happens for ~36h.
-
Day 3
Document review. If the DUNS record matches your filing, this is silent. If it doesn't, expect a 24-72h round-trip per discrepancy.
-
Day 4
Authority verification call. Phone call to the published number on your DUNS or D&B record. Fixed window, no callbacks. Miss it once and you reset 24-48h.
-
Day 5-6
Cert issued. Email + console drop. CSR-bound; no .pfx for code-signing.
-
Day 6-8
Hardware token shipped. UPS Ground in the US, DHL ex-Salt Lake City elsewhere. Activation flow runs from the CertCentral console.
03Corporate history & acquisitions
Why DigiCert is "DigiCert"If you've been buying SSL since the mid-2000s, almost every brand you remember has been folded into DigiCert. The 2017 Symantec acquisition is the one that mattered for trust ubiquity; the rest is consolidation.
-
2003
DigiCert founded in Lindon, Utah by Ken Bretschneider. Initial focus: SSL certificates and PKI tooling.
-
2012
WebTrust audit, browser-store inclusion across the major roots. The company starts winning enterprise SSL away from VeriSign and GoDaddy.
-
2015
Cybertrust SSL business acquired from Verizon. Brings several legacy enterprise root chains into the DigiCert hierarchy.
-
2017
$950M acquisition of Symantec's website security business. Includes Symantec, Thawte, GeoTrust, RapidSSL - and the Symantec trust failure that triggered Mozilla's distrust ballot.
-
2017-18
Symantec chain re-issuance. DigiCert re-issues every Symantec/Thawte/GeoTrust cert under DigiCert roots within nine months. Painful but cleanly executed.
-
2019
QuoVadis acquired. Adds qualified-certificate (eIDAS) capability for the European market.
-
2021
Clarium Capital + Crosspoint Capital acquire DigiCert for ~$2.7B. Private-equity ownership; financial controls tighten.
-
2023
CA/B Forum hardware-key requirement enforced. DigiCert ships KSP and KeyLocker; pricing on code-signing SKUs effectively doubles for new buyers.
-
2026
KeyLocker per-signature pricing introduced. For low-volume signers (under ~200 sigs/yr), KeyLocker is finally competitive with eSigner. Above that, eSigner remains cheaper.
04Roots & intermediates
As of 2026-Q1DigiCert maintains the broadest set of trusted roots of any commercial CA - a side-effect of the Symantec acquisition. Three legacy roots are scheduled for removal in 2027; if you are issuing now, the modern DigiCert Global G2/G3 chains are what you want.
| Root | Algorithm | Validity | Ubiquity | Status |
|---|---|---|---|---|
| DigiCert Global Root G2 | RSA 2048 | 2013-2038 | 99.94% | Modern · use this |
| DigiCert Global Root G3 | ECDSA P-384 | 2013-2038 | 99.91% | Modern · ECC |
| DigiCert Trusted Root G4 | RSA 4096 | 2013-2038 | 99.88% | Modern · long-lived |
| DigiCert High Assurance EV | RSA 2048 | 2006-2031 | 99.96% | Legacy · still trusted |
| GeoTrust Global G2 | RSA 2048 | 2017-2038 | 99.6% | Inherited from Symantec |
| Thawte RSA CA 2018 | RSA 2048 | 2018-2038 | 99.4% | Inherited from Symantec |
| VeriSign Class 3 G3 | RSA 2048 | 1999-2036 | - | Distrusted, do not use |
| Symantec Class 3 G4 | RSA 2048 | 2009-2038 | - | Distrusted, do not use |
05Support & SLA
Channels DigiCert actually answersMid-tier on the way in (chat picks up fast for sales), top-tier once you're a customer with a console login (good engineers on chat for technical issues), bottom-tier for billing or contract changes (slow tickets).
06Alternatives
If DigiCert isn't the right fitFor 90% of buyers, one of these three is what you actually want.
SSL.com
Buy here · most use cases
Cleaner code-signing flow, better cloud signing (eSigner), faster median issuance. The only thing they can't do is Microsoft kernel-mode attestation.
Read the SSL.com review →Sectigo
Buy here · for catalog breadth
Largest catalog at sane prices. Slightly behind on cloud signing; chain widely allow-listed. The default for "I just need an OV cert at a fair price."
Read the Sectigo review →Entrust
Buy here · regulated industries
Pricier than DigiCert in most categories, but the answer if your compliance auditor asks for "Entrust" by name. Strong qualified-cert (eIDAS) story.
Read the Entrust review →07Questions readers send me about DigiCert
Is DigiCert the same company as Symantec / Thawte / GeoTrust?
DigiCert acquired Symantec's website-security business in 2017, including the Thawte, GeoTrust, and RapidSSL brands. Certs sold under those brand names since 2018 chain to DigiCert roots. The brands are mostly retired; what remains is DigiCert.
Why is DigiCert so much more expensive than Sectigo or SSL.com?
The same browser trust, the same crypto, a much heavier sales and procurement layer, and a market position built on enterprise contracts. The price difference does not buy you a better certificate - it buys you a chain that some enterprise allow-lists specifically require.
Do I need DigiCert for code-signing in 2026?
Only if you are signing Windows kernel-mode drivers. For everything else (regular Authenticode, macOS, Linux), SSL.com EV Code Signing is the better-priced equivalent.
What is KeyLocker and how does it compare to eSigner?
DigiCert KeyLocker and SSL.com eSigner are both cloud-hosted signing services that sit in front of an HSM-protected private key. KeyLocker's per-signature pricing got competitive in February 2026; for low-volume signers, the two are now within 10% of each other on cost. For high-volume signers, eSigner is still cheaper.
Can I migrate my DigiCert certs to a different CA?
You don't migrate certs - you re-issue them on the new CA's chain at next renewal. The migration cost is your CSR generation, your DNS validation, and an hour of automation work.
Is DigiCert's hardware token the same YubiKey as SSL.com's?
Both ship YubiKey 5 FIPS devices. The difference is in the configuration profile and the activation flow. Tokens are not interchangeable across CAs - the keypair is generated on-device during activation and pinned to that CA's PKI.
08Full verdict, with the reasoning
6.4/10. Conditional recommendation. DigiCert is a fine CA technically and an over-priced one commercially. The cases where I buy from them are narrow and well-defined: kernel-mode signing, and procurement-driven chain allow-lists. Outside those two cases, I save my clients 50-70% by buying the same product (browser-trust-equivalent) from Sectigo or SSL.com.
The acquisition history is part of why this is true. DigiCert paid $950M for Symantec's website-security business in 2017 and has been working that capex back out of its customer base ever since. The enterprise sales motion is good; the per-cert economics, for a single buyer, rarely make sense compared to the alternatives.
I keep a DigiCert account active. I check it once a quarter. I buy from them when the use case demands it, and not otherwise.