DigiCert 2FA: how to set up an authenticator app for CertCentral

DigiCert CertCentral is where companies order and manage their TLS/SSL and other certificates. You can't opt out of two-factor authentication (2FA) there: DigiCert requires it for all CertCentral accounts, and an administrator decides which second factor each user gets (DigiCert). The choices are a one-time password (OTP), sent by email or made by an app on your phone, or a client certificate installed in your browser. This guide covers the app option, using Authenticator App - Novaz on iPhone. Any authenticator app that makes time-based codes works the same way.

How we checked this guide: the DigiCert steps come from DigiCert's own product documentation, linked below, which we read on October 21, 2026. We haven't tested them on a CertCentral account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

There's no switch to look for

You won't find a personal 2FA setting in CertCentral. An administrator sets the default second factor for the whole account under Settings > Authentication Settings, on the Default settings tab, and can override it for one person on the Two-factor authentication tab with Add 2FA requirement. For an authenticator app, the method is One-time password (OTP) with App/device ticked (DigiCert). Either way, the change applies the next time each user signs in (DigiCert).

If you get email codes and want the app instead, ask your administrator.

Set up your authenticator app

Once the app method applies to you, CertCentral walks you through it at sign-in (DigiCert):

1. On the CertCentral sign-in page, enter your username and password and select Sign in. You land on the One-time password (OTP) device initialization page.
2. On a brand-new account, CertCentral may first ask you to set a password and a security question. Take note of that answer: you'll need it to reset your app later. DigiCert's own article marks these two steps as still to be confirmed, so they may not appear.
3. Under Install an authentication application, pick an app from the dropdown. DigiCert lists the apps it has tested, and Novaz isn't among them. Its pages don't say what to choose when your app isn't listed.
4. Under Scan QR code or enter setup key, scan the code: in Novaz, tap +, then Scan QR code. If the page is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
5. If you'd rather type it, CertCentral calls the text version the setup key. In Novaz, tap +, then Enter key manually, fill in Service (for example, DigiCert) and paste the key into Setup key. See What is a 2FA setup key?
6. Under Enter verification code, type the current code from Novaz and select Verify device.

DigiCert's documentation doesn't say how many digits its codes have or how often they change. Scanning the QR code is the safer route, because it carries those settings to the app.

No backup codes

The CertCentral pages don't mention backup or recovery codes. Recovery runs through the email address in your profile, your security question and your administrators, so keep that address current. This matters with Novaz if you haven't made a backup, because its keys then exist only on that iPhone.

When CertCentral asks for a code

The setup page says you'll use the app each time you sign in. An administrator can soften that by turning on Remember verification for 30 days under One-time password (OTP) settings. You then see Remember verification on this computer when you enter a code, and you're asked again after 30 days. This applies only to app codes, not email codes (DigiCert).

If CertCentral rejects your code

Be careful with retries: too many wrong codes lock you out, and then only an administrator can reset your app (DigiCert). Before you try again, check that your iPhone sets its own time: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

New phone or lost phone

This is where CertCentral is easier than most services: you can reset the app yourself, without an administrator (DigiCert).

1. Sign in with your username and password.
2. On the One-time password (OTP) device initialization page, under Reset your OTP device, select Reset Device.
3. Open the email titled Your DigiCert OTP Device Reset Request and follow its link.
4. Answer your security question and select Continue.
5. Set up the app again on the new phone, as in the steps above, and finish with Verify device.

With a Novaz iCloud backup or backup file, a new phone doesn't need this reset: restore your accounts there instead. Without one, it does. See How to transfer your authenticator app to a new iPhone.

If you're locked out after too many wrong codes, a CertCentral administrator has to reset you: on the Two-factor Authentication tab, under One-Time Password (OTP) methods, they select Reset next to your name, and you get an email with a link. An administrator with no other administrator to do this should contact DigiCert Support right away. DigiCert doesn't say what proof Support asks for or how long it takes. More in Lost the phone with your authenticator app?

DigiCert ONE accounts

DigiCert ONE has its own DigiCert account sign-in, where 2FA is also mandatory unless Support grants an exception (DigiCert). Setup starts from an email titled Update your account: scan the QR code or select Get a setup key, then Set up mobile authentication (DigiCert). With SAML single sign-on, DigiCert still asks for its own code (DigiCert).

Official DigiCert help

• Configure two-factor authentication
• Set up your OTP app
• Set the default second factor
• Create a user-specific two-factor authentication requirement
• Enable 30-day device verification for OTP app authentication
• Reset your OTP app or verification email or your client certificate
• Set up an authenticator application (DigiCert ONE)
• Update 2FA (DigiCert ONE)
• Learn more about 2FA (DigiCert ONE)