The DigiCert X9 PKI for TLS certificate is built for non-browser TLS and mutual TLS (mTLS) authentication. It is issued under the ASC X9 standards for the financial industry and is designed for APIs, host-to-host connections, inter-bank networks, payment processing and other connections between trusted partners.
One certificate can include up to 250 fully qualified domain names and IP addresses. It supports RSA (2048, 3072 and 4096-bit) and ECC (P-256 and P-384) keys and carries both Server Authentication and Client Authentication usage by default. Free reissues and duplicates are included for the life of the certificate. Available for 1, 2 or 3 years. Official DigiCert description
-
Organization validation
Before the certificate is issued, DigiCert completes X9 PKI Organization Validation of your company, so keep your company details ready. A CSR is required and it must use an RSA key of at least 2048 bits. Our validation manuals describe how organization validation usually works.
-
SAN support enabled
One X9 certificate can secure up to 250 fully qualified domain names and IP addresses. Each additional name is added for an extra price, shown in the SAN box above. Wildcard domains are not supported.
-
Not for public websites
X9 PKI is governed by the ASC X9 standards and has its own certificate policy, independent of the browsers. It is meant for mTLS, APIs and host-to-host connections, not for browser-facing websites. Systems that rely on the certificate must have the X9 Financial PKI root certificate in their trust store. For public websites choose a browser-trusted DigiCert SSL certificate.
-
RSA and ECC keys
Order with an RSA key of 2048, 3072 or 4096 bits, or an ECC key on the P-256 or P-384 curve. Both Server Authentication and Client Authentication usage are included by default, which suits mutual TLS between two parties. In the initial release DigiCert issues ECC certificates from RSA intermediate CA certificates.
