Changes to DigiCert, Symantec, Thawte, and GeoTrust Products

OpenSRS is updating the SSL product lineup from DigiCert, Symantec, Thawte, and GeoTrust. This article summarizes which products are being discontinued, how existing and new orders will behave, and what you need to do as a reseller to keep your SSL ordering workflows working.

About this change

Effective September 30, 2020, several DigiCert, Symantec, Thawte, and GeoTrust SSL products were discontinued, and the configuration of remaining products changed. The changes affect which products you can purchase, how SAN and wildcard certificates behave, validation methods, server-type values, and what features can be specified at order time.

If you order or manage SSL certificates through the OpenSRS Reseller Control Panel or API, review the lists below to understand what changed and adjust your integrations and customer-facing offerings accordingly.

Discontinued products

The following SKUs can no longer be purchased:

• quickssl
• thawte_csc (Thawte Code Signing)
• securesite_ft
• securesite_pro_ft
• securesite_ev_ft
• securesite_pro_ev_ft
• truebizid_ev_ft

Changes to existing and new orders

The following configuration changes apply to remaining and newly ordered DigiCert, Symantec, Thawte, and GeoTrust SSL products:

• SAN limit increased. All SAN-supported GeoTrust, Thawte, and DigiCert products now support up to 250 SANs.
• New wildcard + SAN products. New product offerings cover both a wildcard Common Name (CN) and additional SANs.
• Subdomain SANs replaced with wildcard + SAN. A subdomain of the CN is no longer considered a valid SAN. Orders that previously relied on this behavior will be automatically upgraded to a wildcard + SAN certificate offering.
• QuickSSL Premium supports standard SANs. QuickSSL Premium now supports regular SANs and is no longer tied to subdomains.
• Server count fixed at 1. You can no longer specify a server count greater than 1.
• Special Instructions removed. Special Instructions are no longer configurable on orders.
• Trust Seals discontinued. Trust Seals are no longer produced by the certificate vendor.
• DNS or file validation can be swapped. Pre-existing orders that use DNS or file validation can be swapped to any other validation method.
• Email validation cannot be swapped. Pre-existing orders that use email validation cannot be swapped to a different validation method.
• QuickSSL renamed. Existing QuickSSL products are labeled as QuickSSL Premium.
• SANs no longer included free. New SAN-compatible product orders do not include free SANs; they must be purchased on top of the base product.
• Server type values changed. Compatible server_type values have changed. Previously supported values that are no longer valid are translated to a new server_type for re-ordering.

Supported server types

For the current list of supported server_type values and other SSL service parameters, see the sw_register-trust_service API documentation.

What you should do

• Audit your product catalog. Remove discontinued SKUs from your storefront and replace them with the supported equivalents.
• Update API integrations. Confirm your ordering integrations send valid server_type values and do not specify a server count greater than 1, Special Instructions, or free SAN expectations.
• Plan for wildcard + SAN orders. If your customers previously used subdomain SANs on a CN, prepare to order the new wildcard + SAN products instead.
• Review pending orders. Check open orders that use email validation, since they cannot be swapped to another validation method.

Next steps

• Review the API reference for the current product list and parameters in the sw_register-trust_service API guide.
• Read about the Symantec rebrand in to understand related product name changes.
• Browse all SSL topics in for related ordering, validation, and management articles.

Questions? Contact OpenSRS Support.