Notice on DigiCert TLS Certificate G5 Root Switch

Dear Customer:

Hello! Thank you for your continued trust and support in Racent!

DigiCert will upgrade the root certificate for its issuance services in the China region in February 2027, and will subsequently conduct annual intermediate CA rotations.To ensure a smooth transition for your business, please be informed of the following matters:

1. From February 2027: China-region TLS certificates switch to the G5 root hierarchy
According to the v1.8 root certificate trust policy released by the Google Chrome Root Store on February 5, 2026 (requiring each CA to retain at most 2 trusted root certificates in the Chrome Root Store), DigiCert will upgrade the root certificates for certificate issuance services in the China region starting from February 2027. After the upgrade, newly issued SSL/TLS certificates will switch to the DigiCert TLS RSA4096 Root G5 and DigiCert TLS ECC P384 Root G5 root certificate hierarchy.

The main impacts are as follows:
Most users do not need to take any action: newly issued certificates will automatically include the new G5 root certificate hierarchy, and the system will handle this by default.
Already issued certificates are not affected: any certificate issued before the switch to the G5 root will continue to work normally until the end of its validity period.

2. Starting October 15, 2027: Annual ICA Rotation Begins

This G5 hierarchy transition is the first step in DigiCert's long-term planning. Starting October 15, 2027, DigiCert will also launch an annual rotation program for browser-trusted TLS intermediate certificates (ICAs), gradually transitioning toward ICAs and root certificates with shorter validity periods. We recommend that you plan ahead and stay informed.

For special scenarios such as hardcoded or pinned intermediate CA certificates, note the following: be sure to deploy the full certificate chain that includes the new G5 intermediate CA and add the new certificate to the trust store; remove any policies that hardcode or pin CA certificates to avoid service interruptions caused by certificate rotation.

If there are any updates to the official information, we will sync them at the earliest opportunity.We recommend that you continue to monitor the announcements for the latest updates.

Racent (www.racent.com) is committed to automated SSL certificate operations, offering automation solutions such as sslTrus CLM and CaaS. As a professional digital certificate provider and a compliance agent for globally renowned CAs, it delivers trusted digital certificate products.