Knowledge Base

This knowledge base article lists the public DigiCert Intermediate Certificate Authority (ICA) and Root certificates that expire in the next 42 months (3 ½ years). Use this page to track when the ICA and root certificates in your certificate chains expire.

We will periodically update the lists of certificates as we add more expiring certificates and remove expired certificates.

• Expiring root certificates
• Expiring cross-signed root certificates
• Expiring ICA certificates

Move off any expiring ICA and root certificates as soon as possible to avoid service interruptions. When an ICA/root hierarchy expires, you can no longer issue TLS, code signing, and other digital certificates from that expired hierarchy.

Until you move to a new ICA/root hierarchy, you may be unable to renew expiring certificates, get needed new certificates, etc., potentially causing an array of service interruptions, such as an expired TLS certificate preventing customers from accessing your site.
 

What to do if the ICA or root certificate you use is listed below

• Move to a different public root and intermediate CA certificate hierarchy.
  
  Before the ICA or root certificate expires, you must move to a different public root and intermediate CA certificate hierarchy.
  
  Please contact your account representative if you need help moving to a new CA certificate hierarchy.
   

• Do you pin ICA or root certificates or hard-code certificate trust?
  
  Then, you must update your environment to ensure certificates issued from the new certificate hierarchy are trusted before moving to the new hierarchy (in other words, they can chain up to their trusted root certificate).
  
  DigiCert recommends that you stop pinning and hard-coding root and ICA certificate acceptance. Stopping these practices makes moving to new ICA certificates or root certificate hierarchies easier.

Expiring DigiCert public CA certificates

The public intermediate CA (ICA), cross-signed root, and root certificates listed below expire in the next three years. 

Items to note:

• When the root certificate expires, so do all intermediate CA (ICA) certificates chaining to it. You must move to a different root certificate hierarchy.
• When only the ICA certificate is expiring, you may be able to move to another ICA certificate issued from the same root.
• When the cross-signed root certificate expires, there may be another cross-signed root certificate you can use if one is still needed.

Expiring root certificates

Expiring cross-signed root certificates

Expiring ICA certificates