[Notice] CFCA Global Trust Server Certificate Intermediate Root Upgrade Notice
Dear customers and partners,
Hello! Thank you for your continued trust and support for Racent.
We have received a notice from CFCA (China Financial Certification Authority): To continuously improve the security and compatibility of certificate services, CFCA has recently upgraded and updated the intermediate root certificates for OV (Organization Validation) and EV (Extended Validation) SSL/TLS certificates under its system. This adjustment is primarily designed to better adapt to the security requirements of mainstream browsers and improve the agility and long-term reliability of certificates.
Change Description
This update mainly targets the intermediate root certificates of Organization Validation (OV) and Extended Validation (EV) SSL/TLS certificates under the CFCA system. The new intermediate root certificates are re-issued by the original top-level root.
- Applicable Scope: All SSL/TLS certificates issued based on CFCA EV ROOT and CFCA OV ROOT.
- Effective Date: Starting from June 15, 2026, newly issued, renewed or re-issued OV and EV certificates will be signed by the new intermediate root certificate by default.
Impact on Your Business
This intermediate root certificate upgrade will adopt a smooth transition method to maximize business continuity:
-
Existing certificates are not affected: Existing certificates that have been issued and are within the validity period can continue to be used normally before expiration, with all security attributes and browser compatibility remaining unchanged.
-
Newly issued, renewed or re-issued certificates require synchronized certificate chain updates: New certificates obtained after June 15, 2026 will use a brand new certificate chain (i.e., bound to the new intermediate root certificate). When deploying new certificates on the server, you must update the certificate chain simultaneously to ensure that browsers can correctly establish the trust chain and avoid security warnings.
Operation Recommendations
1. Obtain the new intermediate root certificate
When issuing and downloading new certificates, the certificate package provided by the system includes the latest intermediate root certificate by default. You can also visit the CFCA official website, click Services & Support > Certificate Chain Download > Global Server Certificate Chain sequentially through the navigation bar to download the latest certificate chain file yourself.
2. Synchronous configuration and system check
When deploying new certificates, please deploy the new intermediate root certificate together with the server certificate (i.e., configure the complete certificate chain). After configuration is complete, it is recommended to use a third-party SSL detection tool to check the website and confirm that "certificate chain is complete" is displayed, to avoid some browsers prompting that the certificate is untrusted due to missing chain configuration.
3. Client compatibility
The new intermediate root certificate is compatible with current mainstream operating systems and mobile devices, and there are no compatibility change issues, please use it with confidence.
4. Special notice for pre-embedded intermediate root certificates on clients
If you have pre-embedded the original intermediate root certificate on the client, when using a new certificate issued by the new root certificate, client verification exceptions may occur, which may lead to service interruption. We recommend that you remove the pre-embedded operation before the old certificate expires and switch to using the system's built-in trust store for verification. If you have any questions, please feel free to contact the Racent technical support team for assistance.
Racent will continue to provide you with SSL certificates and SSL certificate automation solutions. If you have any questions about this intermediate root upgrade, please feel free to contact us at any time. You can obtain professional support and services through online customer service or by calling the service hotline 400-002-9968. We will do our best to assist you in completing the smooth transition. Thank you again for your support and trust!
Shanghai Racent Information Technology Co., Ltd. June 15, 2026