DigiCert licensing is the set of terms under which DigiCert sells digital certificates and the software and services used to issue, manage and apply them. DigiCert describes itself as a software company and a trusted third-party certification authority that provides digital trust solutions, including certificates and other trust products, software and services.[1] For a software asset manager the subject has two halves. The first is public-trust certificates ordered through CertCentral, where the commercial unit is a domain name, an email address or an organization and the term is one year by default. The second is the DigiCert ONE platform products, where the commercial unit is a seat, a unit of signatures or a device, and quantities are set in a Quote.[2][3]
Unlike most software, a certificate is not installed under a licence key. The licence is a right to have a certificate issued, to keep it active and to use it for a stated purpose, and it can be revoked. DigiCert’s terms for publicly trusted TLS/SSL certificates say that use is limited to domain names the subscriber owns or is authorized to use, and that revocation can be required within 24 hours or 5 days under industry rules.[4] That makes certificate licensing a continuing obligation, not a one-time purchase. Catalog proof: Entitlements expire with no credit, refund or rollover; Web PKI certificate may only be used for authorized domains on systems you control.
Contract documents
DigiCert’s agreements form a stack. The Master Services Agreement (MSA) is the base contract and incorporates the Service Specific Terms by reference. Customers accept it by using the services, by accepting it online or by agreeing an Order Form that references it.[1] The Service Specific Terms point to the applicable Certificate Terms of Use and Certification Practices Statement for certificate orders, and to a Services Addendum for DigiCert ONE products and enterprise certificate subscriptions.[5] The Services Addendum, in turn, holds the seat and unit descriptions in its Schedule 1 and states that each Quote accepted by the customer constitutes an Order Form.[3] Services ordered on subscription through CertCentral or another portal are further governed by the Transactional Subscription Terms and Conditions, which prevail over the MSA in a conflict.[6]
The article DigiCert Master Services Agreement and service terms walks through these documents, the audit clause, the Excess Usage Fee and the annual price escalator.
Product lines and how they are measured
DigiCert’s documentation separates “trust sources”, which issue certificates, from “trust workflow” products that manage, automate or apply them. CertCentral issues publicly trusted certificates and DigiCert Private CA issues private ones. Trust Lifecycle Manager, Software Trust Manager, Device Trust Manager, Content Trust Manager and DigiCert DNS are the workflow products.[2]
| Product line | Metric as DigiCert documents it | Deeper article |
|---|---|---|
| CertCentral public certificates | Annual or Multi-year Plan per certificate order on Enterprise, Partner and Legacy accounts; 12-month subscription per protected asset on Subscription accounts[7] | CertCentral and TLS certificate licensing |
| Trust Lifecycle Manager | Trust Lifecycle Manager Seat per server, Site, user or device under the current Essentials, Advanced and Premium plans[8] | Trust Lifecycle Manager and Private CA licensing |
| DigiCert Private CA | Licences for private roots, intermediate CAs and end-entity certificates[9] | same |
| Software Trust Manager | Units of up to 1,000 software signatures, with included HSM keypairs, on the current model[10] | Software, Device and Content Trust Manager licensing |
| DigiCert KeyLocker | 1,000 signatures and one signer per certificate for each year of validity[11] | same |
| Device Trust Manager | Essentials licence per certificate; Advanced licence per registered device[12] | same |
| Content Trust Manager | Seats and signature units[13] | same |
| DigiCert DNS | Query Seat of up to one million authoritative queries, one-month entitlement period[3] | same |
Each of these rows maps to a catalog row; see Trust Lifecycle Manager Essentials, DigiCert Private CA, Software Trust Manager Essentials, Device Trust Manager Advanced and DigiCert KeyLocker.
DigiCert does not publish prices for the DigiCert ONE plans. The documentation says seat pricing varies by plan and refers readers to contact DigiCert.[8] The catalog therefore holds no list prices.
Current and legacy licensing models
DigiCert has recently changed how several products are metered, and an installed estate can contain both models. Trust Lifecycle Manager moved to a current model in October 2025, with a single seat type across three plans; subscriptions that began earlier and have not been transitioned keep seven separate seat types.[8] DigiCert Private CA made a similar change in October 2025.[9] Software Trust Manager introduced its current model in September 2026, and earlier subscriptions keep separate signature, cryptographic, test signature, threat detection and HSM keypair units.[10] The Services Addendum states that seat types marked “(Legacy)” may not be available for new purchases but may continue to be used by customers who previously bought them.[3] Catalog proof: Legacy and current licensing models; Legacy seat types remain usable but may not be sold.
Counting, overage and renewal
Quotes set the entitlement and a stated period for each, such as quarterly or annual. Entitlements expire at the end of the period with no credit, refund or rollover, and a customer that exceeds an entitlement owes an Excess Usage Fee, invoiced at the end of the period applicable to the excess services.[3] The fee is the number of excess entitlements multiplied by the price of the entitlement. For certificate subscriptions bought on a minimum commitment basis, the excess is measured at peak usage during the entitlement period.[3] The subscription terms add that the customer authorizes DigiCert to charge any excess usage fee automatically to the payment method on the account at the start of the next Service Term.[6]
Two features of the Services Addendum affect cost planning. Fees increase on each anniversary of a Quote by the greater of 3% and the percentage increase in a regional consumer price index.[3] And DigiCert may audit installations and use on at least ten days’ written notice; overuse is charged at DigiCert’s then-existing list price plus interest, and overuse above 5% of the entitlement also shifts the audit costs to the customer.[3] Catalog proof: Excess Usage Fee; Inflation Adjustment; DigiCert may audit entitlements on ten days’ notice.
Hosted and on-premises limits
For most DigiCert ONE products the documentation distinguishes between DigiCert-hosted and on-premises customers. Hosted customers generally have a soft limit and can exceed the allotted licences, incurring overages. On-premises customers have a hard limit and cannot exceed the allotted number.[14][9] Some hosted limits are hard, such as legacy HSM keypair units and KeyLocker signatures, which cannot be exceeded without a licence amendment or a purchase of more signatures.[15][11] A software asset manager reconciling entitlements should therefore record not only the quantity bought but also the deployment model for each product.
Purchasing routes
Customers can buy directly from DigiCert on a Quote or through an authorized channel partner. Where Certificate Subscription Services are bought through a partner, pricing and payment terms are those agreed with the partner, the customer must tell DigiCert about a partner election or change, and DigiCert reserves the right to invoice the customer directly for usage under the Quote.[3] Purchases made for resale rather than for the customer’s own use fall under a separate Master Partner Agreement.[1] Customers on CertCentral Enterprise and Partner accounts can also pay from prepaid account credit, which Subscription accounts cannot use.[16]
Out of scope
This article does not cover DigiCert’s Certification Practices Statements, the CA/Browser Forum requirements as such, or QTSP Services, which are provided by an affiliate qualified trust service provider under a separate legal repository. It does not cover third-party products that DigiCert resells, such as Thales hardware or services, which are subject to the supplier’s own terms.[5] It also does not cover the DigiCert English-language Master Services Agreement text directly (see the notice above), the Relying Party Agreement, or professional services statements of work.