TORONTO, Canada, November 7, 2026 -- DigiCert will switch the default public TLS issuance hierarchy from its Global G2 and G3 roots to dedicated G5 TLS roots on November 12, 2026, between 11:00 and 13:00 MST (18:00 to 20:00 UTC). From that point, new orders, renewals, reissues, and duplicates of browser-trusted TLS certificates will be issued from G5 roots by default. Securetron, maker of PKI Trust Manager, says the change is an inventory and trust-store problem before it is a renewal problem.

The migration is a planned root hierarchy change, postponed from October 15, and it is not a security incident. Certificates already issued from G2 and G3 roots remain valid until they expire or are revoked. But the runway for staying on the old roots is short and shrinking. DigiCert will let customers keep selecting G2 and G3 chains until June 8, 2027 without a special exception, yet any certificate issued from those hierarchies will expire no later than September 14, 2027. Validity truncation for G2 and G3 certificates begins February 28, 2027, industry-wide maximum TLS validity drops to 99 days on March 15, 2027, and Chrome stops trusting certificates issued from G2 and G3 roots on September 15, 2027.

"The question most teams cannot answer today is which certificates they actually have, which chain each one sits on, and where that chain is pinned or trusted," said Sarah Reid, Securetron. "A root migration does not break the certificates you already issued. It breaks the ones you did not know existed, in the systems whose trust stores nobody updated. You cannot plan a migration around an inventory you do not have."

That inventory gap is the practical risk. Every certificate, its issuing chain, its expiry, and every place the chain is pinned or trusted has to be known before November 12, and the same discovery work has to be repeated as validity keeps shrinking. G5 roots have been added to trust stores, including Microsoft's, since 2021, but DigiCert itself notes that not every browser, operating system, or application has been updated to include them. Cross-signed roots can bridge the gap for clients that do not yet trust G5, but only for chains the team has actually found.

Enterprises are already moving. SAP Concur is renewing its API certificates on November 10 ahead of a February 2027 expiry and plans to migrate its public certificates to the G5 chain in April 2027, warning customers who pin certificates to add both the DigiCert TLS RSA4096 Root G5 and DigiCert TLS ECC P384 Root G5 roots to their trust stores first.

PKI Trust Manager is built for exactly this kind of transition. It continuously discovers certificates, expiring assets, and vulnerabilities across the enterprise, automates issuance, renewal, and monitoring for the entire certificate lifecycle, and gives teams a single pane of glass across ADCS, MSCA, Let's Encrypt, DigiCert, and ACME, with full audit trails for every action. Its built-in ACME server, plus SCEP and EST, lets existing tools and network devices enrol automatically, and Boltron-AI discovers applications and services, profiles their configurations, and generates onboarding runbooks. The Community Edition is free for up to 500 certificates.

"Root migrations reward the teams that already know their estate," Reid added. "Discovery first, then the migration plan. The teams still working from spreadsheets will be the ones finding G2 chains in February."

About Securetron:
Securetron builds PKI Trust Manager, an enterprise certificate lifecycle management platform that automates discovery, issuance, renewal, and compliance for certificates across ADCS, MSCA, Let's Encrypt, DigiCert, and ACME, with AI-driven onboarding from its Boltron-AI module. Learn more at https://securetron.net.

Press Contact:
Sarah Reid, Securetron
1 Yonge St, Toronto, ON M5E 1E6, Canada
+1 (438) 927-8036
[email protected]
https://securetron.net