DigiCert has announced an update to the public issuance schedule for its TLS/SSL certificates. Starting November 12, 2026, between 18:00 and 20:00 UTC, publicly trusted TLS certificates from all brands in CertCentral® and CertCentral Europe will be issued by default from its new DigiCert G5 TLS root hierarchies.
This change, rescheduled from its original date of October 15, aims to ensure an orderly and smooth transition for all administrators and network infrastructure.
New default root hierarchies
Starting November 12, certificates will be issued by default from:
- DigiCert TLS RSA4096 Root G5
- DigiCert TLS ECC P384 Root G5
The current root hierarchies (DigiCert Global G2 and G3) will not disappear immediately: they will remain available on explicit request for regular issuance until June 8, 2027.
How does this change affect your website or server?
In most cases, no action is required if you follow the usual best practices when installing certificates:
- Certificates issued after November 12: They will automatically chain to the new G5 hierarchy, unless you specify otherwise in the order.
- Certificates issued before November 12: They will remain valid and keep the original root hierarchy they were created with until their normal expiration date.
Key note: If you always install the Intermediate Certificate Authority (ICA) certificate provided by DigiCert on your servers together with the main TLS certificate, the transition will happen without interruptions.
Do you need to keep using the G2 or G3 hierarchies?
If you need to keep using G2 or G3 after the change date for compatibility with legacy systems, you can do so through the CertCentral platform.
Using the ICA certificate chain selection feature, you can:
- Choose the issuing intermediate CA when requesting a TLS certificate (DV, OV or EV).
- Set a default intermediate CA by product type.
- Explicitly select the corresponding ICA through the services API.