NewsPublished 5 May 2026

SSL.com rotates their root certificate today, (Tue, May 5th)

Source SANS ISC Handlers Diary

Description

I just got an email from SSL.com last night, they are rotating &&#x23;x26;&#x23;xc2;&&#x23;x26;&#x23;xa0;out their root certificate today (May 5,2026). &&#x23;x26;&#x23;xc2;&&#x23;x26;&#x23;xa0;This is normal, business as usual stuff for a CA, but certificates get used for all kinds of things, and sometimes they aren&&#x23;x26;&#x23;39;t used like they should be, so sometimes hiccups happen.

Impact

No direct security vulnerability or exploit is reported. The impact is primarily operational, potentially causing service disruptions for users with custom or pinned trust configurations relying on the outgoing root certificate. Basic certificate and website usage is not expected to be affected. There are no known exploits in the wild related to this root certificate rotation.

Defensive guidance

Users should audit any pinned trust anchors, custom trust stores, or certificate validation logic tied to the 2016 root certificates to avoid disruptions. Employ cross-certificates to bridge compatibility between the old and new root hierarchies during the transition. Migrate to dedicated client certificates for client authentication to comply with upcoming browser requirements. For basic certificate usage, no action is required. Review SSL.com's official advisory at https://www.ssl.com/article/what-ssls-root-migration-means-for-you for detailed guidance.

Summary

SSL.com is performing a scheduled rotation of its root certificate on May 5, 2026. This root certificate rotation is a normal lifecycle event for certificate authorities. The change may impact systems that have pinned trust anchors, custom trust stores, or certificate validation logic specifically tied to the 2016 root certificates. To mitigate potential disruptions, SSL.com advises auditing such configurations and using cross-certificates to maintain compatibility during the transition period. Additionally, migrating to dedicated client certificates is recommended to comply with upcoming Google Chrome server authentication requirements affecting SSL/TLS certificates with the ClientAuth EKU.

References

isc.sans.edu/diary/rss/32956 (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 5 May 2026, 11:36 UTC

References

Community reviews