All Systems Operational

Updated a few seconds ago

Certificate Issuing Platforms

Operational

Certificate Lifecycle Management Platforms

Operational

Certificate Revocation Platforms

Operational

Certificate Transparency

Operational

Websites

Operational

Client Areas

Operational

Time Stamping

Operational

Scheduled Maintenance

Reminder: Sectigo Public Root CA Migration – Completed Updates & Upcoming ChangesPlanned Maintenance

Schedule

March 1, 2025 12:00AM - June 2, 2025 12:00AM UTC

Components

Certificate Issuing Platforms, Certificate Lifecycle Management Platforms

Locations

Public CA, SCM (cert-manager.com), SCM (hard.cert-manager.com), SCM (eu.cert-manager.com)

Description

This is a reminder about the ongoing transition to Sectigo’s new Public Root CAs — an important initiative to maintain the security, trust, and compliance of digital certificates across modern platforms. We appreciate your attention to the previous notifications sent prior to each migration phase, which helps minimize any potential issues during and after these transitions. Summary Overview: Sectigo has successfully incorporated its new Public Root CAs into all major root stores, including Mozilla, Microsoft, Apple, and Google/Chrome. These new roots deliver enhanced security, improved trust, and continued compliance with evolving industry standards, ensuring your certificates remain valid and fully supported across major systems and devices. As part of this effort, Sectigo has been migrating certificate issuance to the new Public Roots in phases. Completed Migrations: ✅ S/MIME Certificates — March 1, 2025 ✅ EV TLS Certificates — April 15, 2025 ✅ OV TLS Certificates — May 15, 2025 Upcoming Migration: DV TLS Certificates — Scheduled for June 2, 2025 For partners using whitelabel Subordinate CAs, our Compliance team will reach out separately with further instructions. Why This Matters: This migration ensures that Sectigo certificates remain secure, fully trusted, and compatible with all modern browsers, operating systems, and applications. It strengthens the protection of your websites, communications, and digital services against evolving threats while keeping your infrastructure aligned with the latest industry standards. Additional Resources: https://www.sectigo.com/sectigo-public-root-cas-migration https://www.sectigo.com/knowledge-base/detail/Sectigo-Public-Intermediates-and-Roots/kA0Uj0000003eovKAA https://www.sectigo.com/knowledge-base/detail/Sectigo-new-Public-Roots-and-Issuing-CAs-Hierarchy/kA0Uj0000004IrB Thank you for your attention and continued partnership!
Scheduled Maintenance 22:59 UTC Sat 14th June 2025 to 01:00 UTC Sun 15th June 2025 Planned Maintenance

Schedule

June 14, 2025 10:59PM - June 15, 2025 1:00AM UTC

Components

Certificate Issuing Platforms, Certificate Lifecycle Management Platforms, Client Areas

Locations

Public CA, SCM (cert-manager.com), SCM (hard.cert-manager.com), secure.trust-provider.com, S3, secure.sectigo.com, SCM (eu.cert-manager.com), api.xolphin.com

Description

Scheduled Maintenance 22:59 UTC Sat 14th June 2025 to 01:00 UTC Sun 15th June 2025 Sectigo Certificate Issuing Platform Scheduled Maintenance: • Minor Fixes • Minor Improvements We anticipate that our certificate issuing platform will be unavailable for up to 2 hours while we add this additional functionality to the system. Please contact your Sectigo support resource if you require additional information about this scheduled maintenance event.
Sectigo Announcement:: Upcoming removal of WHOIS-Based Domain Control!Planned Maintenance

Schedule

June 15, 2025 12:00AM - 12:00AM UTC

Components

Certificate Issuing Platforms

Locations

Public CA

Description

Sectigo Announcement: Recent vulnerabilities in the domain name WHOIS system (https://labs.watchtowr.com/we-spent-20-to-achieve-rce-and-accidentally-became-the-admins-of-mobi/) have highlighted the WHOIS-based domain-validation method as a weakness in the process of validating publicly-trusted digital certificates. As a result, a ballot has been proposed in the CA Browser Forum (CABF) requiring that WHOIS-listed email addresses are no longer acceptable for domain validation, nor can historic domain validations based on WHOIS email addresses be reused. This ballot aims to deprecate the WHOIS-based domain validation method. We are currently investigating the impact of this proposed change. If you use WHOIS-based domain validation methods, we recommend migrating to alternative methods as soon as possible. The proposed removal date has moved from November 1st, 2024 to June 15th, 2025. Sectigo will provide updates on this proposal on: https://www.sectigo.com/whois-email-dcv-deprecation
Scheduled Maintenance 22:59 UTC Sat 21st June 2025 to 01:00 UTC Sun 22nd June 2025 Planned Maintenance

Schedule

June 21, 2025 10:59PM - June 22, 2025 1:00AM UTC

Components

Certificate Issuing Platforms, Certificate Lifecycle Management Platforms, Client Areas

Locations

Public CA, SCM (cert-manager.com), SCM (hard.cert-manager.com), secure.trust-provider.com, secure.sectigo.com, SCM (eu.cert-manager.com), api.xolphin.com

Description

Sectigo Certificate Issuing Platform Scheduled Maintenance Saturday, June 21, 2025; 22:59 UTC. Sectigo Certificate Issuing Platform Scheduled Maintenance: • Minor Fixes • Minor Improvements We anticipate that our certificate issuing platform will be unavailable for up to 2 hours while we add this additional functionality to the system. Please contact your Sectigo support resource if you require additional information about this scheduled maintenance event.
Upcoming Change: SHA-256 to be Used for New TLS Certificates Starting June 23Planned Maintenance

Schedule

June 23, 2025 1:00PM - 1:00PM UTC

Components

Certificate Issuing Platforms

Locations

Public CA

Description

We want to inform you about an upcoming change in the signature hash algorithm used for TLS certificates issued from our new CA hierarchy. Effective June 23, 2025, at 13:00 UTC, newly issued TLS certificates will be signed using the SHA-256 hashing algorithm. This reverses the recent move to SHA-384, based on issues identified in real-world deployments. As SHA-256 was the prior default, we do not anticipate disruptions. Need SHA-256 certificates before June 23? Please reach out to your support contact within Sectigo Looking ahead: In a future release, we plan to make SHA-384 an optional selection for customers wishing to test SHA-384 readiness. Additional development is required before this option will become available. We appreciate your understanding as we take proactive steps to maintain the highest reliability and compatibility of issued certificates. Sectigo Team.
Sectigo Announcement:: Upcoming Multi-Perspective Issuance Corroboration Planned Maintenance

Schedule

September 15, 2025 12:00AM - 12:00AM UTC

Components

Certificate Issuing Platforms

Locations

Public CA

Description

Sectigo Announcement: To comply with new CA/B Forum requirements, Sectigo is introducing Multi-Perspective Issuance Corroboration (MPIC) for Domain Control Validation (DCV) and Certificate Authority Authorization (CAA) checks. This process mitigates security risks by verifying traditional DCV and CAA results from multiple remote network perspectives across different regions. Key Milestones: • February 18, 2025 – MPIC enters a reporting phase. DCV and CAA validation results will be corroborated using multiple remote perspectives, but unsuccessful checks will not affect certificate issuance. • No later than September 15, 2025 – MPIC enforcement begins. Certificates will not be issued if multi-perspective checks fail to corroborate primary DCV or CAA results. (Exact date will be communicated during the summer period.) For further details, including specific validation methods affected, visit our https://www.sectigo.com/mpic-faq
Important Update: Deprecation of Client Authentication EKU from Sectigo SSL/TLS Certificates !Planned Maintenance

Schedule

September 15, 2025 12:00AM - 12:00AM UTC

Components

Certificate Issuing Platforms

Locations

Public CA

Description

Effective September 15, 2025, Sectigo will no longer include Client Authentication (id-kp-clientAuth) in Extended Key Usage (EKU) for newly issued SSL/TLS certificates. This change aligns with updated industry requirements and best practices aimed at improving the security and purpose specificity of publicly trusted certificates. What is changing? For many years, SSL/TLS certificates have commonly included both Server Authentication and Client Authentication EKUs. Moving forward, the Client Authentication EKU will be deprecated in SSL/TLS certificates due to updated requirements from major Root Programs. Important dates Effective September 15, 2025, Sectigo will stop including the Client Authentication EKU in SSL/TLS certificates by default. Effective May 15, 2026, Sectigo will no longer include the Client Authentication EKU in any newly issued SSL/TLS certificates. What do your customers need to do? If they don't use Sectigo SSL/TLS certificates for mutual TLS (mTLS), server-to-server authentication, or other Client Authentication use cases, no action is required. If they are using SSL/TLS certificates for Client Authentication purposes, we recommend they evaluate alternative solutions as soon as possible. For most organizations, Private PKI offers the best path forward to support mTLS and similar use cases. Please contact a Sectigo sales representative to assist with planning and deploying a Private CA tailored to the environment. Need assistance? If you are unsure whether this change impacts your customers, or if you need guidance on migrating to alternative solutions, please contact us at clientauth@sectigo.com. Learn more For additional information, we have prepared a FAQ covering the deprecation timeline, impacted services, and alternative options. https://www.sectigo.com/faq-client-authentication-eku-deprecation Thank you for your prompt attention to this important industry change.