Knowledge Base

Beginning October 15, 2026, DigiCert will change the default public TLS issuance hierarchy from the DigiCert Global G2 and G3 root hierarchies to the dedicated DigiCert G5 TLS root hierarchies.

This article is intended for DigiCert customers who require our current default DigiCert Global G2 and G3 TLS hierarchies beyond October 15, 2026. It explains what changes on October 15, what does not change, the Global G2 and G3 root migration timeline, and how you can control the issuing intermediate CA (ICA) through CertCentral, the CertCentral Services API, ACME, and third-party integrations.

For background on why DigiCert is aligning its root hierarchies with new browser requirements, see DigiCert's Root Strategy: Aligning with New Industry Standards.

In this article

• What changes on October 15, 2026?
• What if I am not ready to move to the G5 root hierarchy?
• Global G2 and G3 roots transition timeline
• ICA certificate chain selection
• CertCentral Services API integrations
• ACME Directory URLs

What changes on October 15, 2026?

On October 15, 2026, DigiCert will make the G5 TLS hierarchies the default issuance path for public WebPKI TLS certificates. CertCentral will use the applicable G5 issuing root hierarchy by default to issue new certificates, renewals, reissues, and duplicates when no ICA is explicitly selected.

CertCentral Global - Default G5 ICAs

CertCentral Europe - Default G5 ICAs

We will update the table in this article once the GeoTrust G5 ICA certificates are available.

What if I am not ready to move to the G5 root hierarchy?

You can continue to use the appropriate Global G2 and G3 ICA certificate after October 15 if DigiCert has enabled the ICA selection feature for your account. This feature lets you select the ICA certificate used to issue your TLS certificate — G2, G3, or G5. See ICA certificate chain selection below.

At this time, no special exception is required to continue using Global G2 and G3 root hierarchies after the default change. However, the G5 root hierarchy is DigiCert's go-forward public TLS hierarchy. Use the transition period to identify and migrate any remaining dependencies on the Global G2 and G3 root hierarchies to the G5 hierarchies.

Global G2 and G3 roots transition timeline

If you continue to use the Global G2 and G3 root hierarchies after October 15, 2026, plan for your TLS certificate validity to be truncated. Certificates issued from these hierarchies will expire no later than September 14, 2027, at 23:59 UTC. The table below lists the key dates in this transition.

Truncation is not continuous. It pauses for about 12 weeks, from March 15 to June 8, 2027, because the industry-wide 99-day validity cap, that takes effect on March 15, is by itself enough to keep any new certificates within the September 14, 2027, cutoff. G2- and G3-specific truncation resumes on June 8, once the 99-day cap alone is no longer sufficient to guarantee that.

ICA certificate chain selection

CertCentral includes an ICA certificate chain selection feature that allows you to control which DigiCert intermediate CA issues a supported public DV, OV, or EV TLS certificate. When the feature is enabled, you can select the issuing ICA certificate when ordering a TLS certificate, configure a default issuing ICA certificate for a product, and explicitly select an ICA through the Services API.

If ICA selection is not enabled

If ICA selection has not been enabled for your account, contact your DigiCert account manager or DigiCert Support, so you can continue using the G2 and G3 ICA certificate chains while you prepare your transition to the G5 root hierarchy.

• After the ICA selection feature is enabled for your account, public TLS order forms include a new menu option: Intermediate chains [Intermediate CA] > [Root CA].
• Enabling ICA selection does not by itself change the current default issuing ICA certificate.
• CertCentral administrators can control which ICA chains are available on the request form from the certificate's Product Settings page.

Select the issuing ICA certificate when ordering a TLS certificate in CertCentral

1. On the CertCentral Dashboard, in the Request a Certificate menu, select a public TLS certificate, such as Basic OV.
2. On the request form, expand Additional certificate options.
3. In the Intermediate chains [Intermediate CA] > [Root CA] menu, select the issuing ICA certificate chain: G2, G3, or G5.
4. Enter the other certificate request information and submit the request.
5. DigiCert will use the selected issuing ICA certificate to issue the TLS certificate.

Configure the default ICA certificate chain for a TLS certificate in CertCentral

If you prefer, set the default issuing ICA chain for a TLS certificate, so you don’t need to select it each time you request a certificate.

1. In CertCentral, go to Settings > Product Settings.
2. On the Product Settings page, use divisions and roles to determine the granularity of your TLS product settings.
3. In the Product column, select the TLS product, such as Basic OV.
4. In the Allowed intermediate chains [Intermediate CA] > [Root CA] menu, select the ICA certificate chains the certificate requestor is permitted to use.
5. In the Default intermediate chain menu, select the ICA certificate chain selected by default on the request forms.
6. To save your changes, select Save Settings.

CertCentral Services API integrations

In your API integrations, you can select the issuing ICA certificate chain for a certificate by including ca_cert_id parameter in the certificate request. The ca_cert_id parameter identifies the intermediate CA that should issue the end-entity certificate.

• If ca_cert_id is supplied and the ICA certificate is enabled for your account and product, CertCentral uses the requested ICA certificate chain to issue the certificate.
• If ca_cert_id is omitted, CertCentral uses the configured default ICA.

Example of a request that includes ca_cert_id

{
  "certificate": {
    "common_name": "www.example.com",
    "csr": "<CSR>",
    "signature_hash": "sha256",
    "ca_cert_id": "<ICA_CERT_ID>"
  }
}

Make sure ICA selection is enabled

Make sure ICA certificate chain selection has been enabled for your account. If an API request specifies an ICA certificate chain that is not permitted for the account or product, CertCentral returns an error.

If you choose to remain temporarily on the Global G2 and G3 root hierarchies, you must explicitly provide the appropriate ca_cert_id or configure the required Global G2 or G3 ICA certificate chain as the TLS product's default selection. See Configure the default ICA certificate chain for a TLS certificate in CertCentral above.

Find the correct ca_cert_id

The Services API Product list endpoint response returns an allowed_ca_certs array containing the name and external ID of each ICA that may issue certificates for the product. The ID returned there is the value to include with the ca_cert_id parameter.

The Product info endpoint also returns the ICA certificates the current user is permitted to select, along with default_intermediate when a customized default has been configured.

Always find the applicable ICA IDs from your own CertCentral account rather than copying an ICA ID from an example.

Recommended integration review

For any automated integration, identify whether the integration:

1. Explicitly sends a DigiCert ICA ID.
2. Has an integration-specific setting that maps to a DigiCert ICA ID.
3. Sends no ICA preference and therefore relies on the CertCentral default.

If the integration relies on the default and no configuration changes are made, issuance will move to the applicable G5 hierarchy when the default changes on October 15, 2026.

ACME Directory URLs

CertCentral ACME Directory URLs include ICA certificate chain selection as part of the ACME URL configuration. When you create an ACME Directory URL, you can optionally select the issuing ICA certificate chain. See Add ACME credentials.

If an ICA certificate chain is selected, certificate requests made through that ACME URL use the selected chain. If no ICA certificate chain is selected, requests use the applicable CertCentral default.

Existing ACME Directory URLs that already have an ICA configured will continue using that ICA after October 15. The October 15 default change does not overwrite an ICA certificate chain selection already configured on an ACME Directory URL.

ACME URLs with no ICA configured will follow the default issuance path and therefore move to G5 when the default changes.

In CertCentral, you can change the issuing ICA certificate chain for an existing ACME Directory URL. The change applies to the next certificate request made through that URL and does not affect certificates already issued. See Update the order and domain restrictions, and issuing ICA certificate for an ACME Directory URL.

You can switch between G5 and Global G2 and G3 hierarchies, select another permitted ICA certificate chain, or remove the explicit ICA chain preference and return the URL to default behavior.