Knowledge Base

Description

On July 15, 2025, at 10:00 MDT (16:00 UTC), DigiCert will make the following changes to our public TLS/SSL certificate issuance process to align with changes in the Google Chrome Root Program:

• Issue public TLS/SSL certificates with only the Server Authentication extended key usage (EKU) by default.
• Temporarily, provide an option to issue public TLS/SSL certificates with both the Server Authentication and Client Authentication EKUs. DigiCert will remove this option from TLS certificate enrollment in June 2026.
• Issue public TLS/SSL certificates from new industry-compliant intermediate CA (ICA) certificates.

Why is DigiCert issuing public TLS certificates with only the Server Authentication EKU from new ICA certificates?

Currently, when DigiCert issues our public TLS, client authentication, code signing, and document signing certificates, they all chain up to the same public Root CAs, such as DigiCert Global Root G2. These are referred to as multipurpose hierarchies.

By default, we also include the Server and Client Authentication EKUs in our public TLS certificates.

On June 15, 2026, Google Chrome will only trust public TLS certificates with the Server Authentication EKU issued from the dedicated TLS server authentication hierarchies, as stated in section 3.2.2 PKI Hierarchies included in the Chrome Root Store in the Chrome Root Program Policy, Version 1.6.

As a result of the Chrome Root Program Policy changes, Google Chrome will distrust any public TLS certificate issued from multipurpose hierarchies, along with TLS certificates with the Server Authentication and Client Authentication EKUs starting June 15, 2026.

Timeline of events with Chrome policy and DigiCert plan

How does removing the Client Authentication EKU affect me?

No action is required if you don’t use the Client Authentication EKU in your TLS certificate process. Removing this EKU from your TLS certificates does not affect you.

What if I use the Client Authentication EKU in my TLS certificate process?

Starting July 15, 2025, DigiCert will issue TLS certificates with only the Server Authentication EKU by default. However, DigiCert will provide an option to include both EKUs in your TLS certificate during enrollment until June 2026.

How does switching ICA certificates affect me?

Switching to a different ICA certificate doesn't require more work as long as you always install the DigiCert-provided ICA certificate when installing your TLS certificate. For more information about certificate chains and how they work, see How Certificate Chains Work.

If you do any of the following things, action is required:

• Pin ICA certificates
• Hard-code the acceptance of ICA certificates
• Operate a trust store

If you do any of the above, we recommend updating your environment before July 15, 2025. Stop pinning or hard-coding ICA certificate acceptance, or make the necessary changes to your environment to ensure certificates issued from the new ICA certificate are trusted (in other words, they can chain up to their trusted G2 or G3 root certificate). 

How does removing the Client Authentication EKU and switching ICA certificates affect my existing certificates?

Switching to a new ICA certificate does not affect your existing certificates' trust. Valid TLS/SSL certificates issued with the Client Authentication and Server Authentication EKUs and/or from multipurpose ICA certificates will remain trusted until they expire.

What about reissues, duplicates, and renewals?

Starting July 15, 2025, DigiCert will issue new, renewed, reissued, and duplicate TLS certificates with only the Server Authentication EKU from new ICA certificates. When installing your TLS certificates, always include the DigiCert-provided ICA certificate.

If you need public TLS certificates with both the Server Authentication and Client Authentication EKUs, make sure to include both EKUs in your certificate during the enrollment.

What if I need more time to update my TLS certificate process?

If you need more time to prepare, contact DigiCert Support. We will set up your account so you can continue using the multipurpose ICA certificate you are using now until you can switch to the new ICA certificate.

Affected DigiCert brands

July 15, 2025, ICA certificate replacement

ICA certificate replacements:

• DigiCert brand ICA certificate replacements
• GeoTrust brand ICA certificate replacements
• Thawte brand ICA certificate replacements
• RapidSSL brand ICA certificate replacements
• Encryption Everywhere brand ICA certificate replacements

DigiCert brand ICA certificate replacements

GeoTrust brand ICA certificate replacements

Thawte brand ICA certificate replacements

RapidSSL brand ICA certificate replacements

Encryption Everywhere brand ICA certificate replacements