Overview

This article explains upcoming industry-driven changes that affect GlobalSign publicly trusted TLS Root certificates and TLS Certificate profiles. These changes are introduced by browser root programs (primarily in Mozilla Firefox and Google Chrome) and the CA/Browser Forum. GlobalSign is updating its infrastructure to remain fully compliant while minimizing customer impact. This page is updated regularly to reflect the latest updates. We recommend bookmarking this page and checking back for the latest guidance.

\The information provided here is for customers on the Atlas platform. For GCC customers, please refer to this page↗. Can't find what you're looking for? Get in touch↗ for assistance.

Important Assurance

• GlobalSign’s existing root certificates are not being revoked.

• Older roots will continue to exist and may still be used for their natural lifetimes for:

  • Non-TLS use cases, or
  • Environments that do not require public browser trust

• Intermediate certificates (ICAs) issued under these root certificates will also not be revoked.

Summary of Key Changes

Browser vendors periodically update their root store policies to improve ecosystem security and consistency. Recent policy updates from Mozilla Firefox and Google Chrome and the CA/Browser Forum introduce three key changes that affect publicly trusted TLS certificates:

1. Maximum root age limits: Mozilla Firefox and Google Chrome will no longer trust TLS certificates that chain to roots older than a defined age.

2. TLS-dedicated root requirements: Publicly trusted TLS certificates must be issued from roots dedicated exclusively to TLS and must contain only the Server Authentication (ServerAuth) EKU.

3. Shorter TLS certificate lifetimes: The CA/Browser Forum has approved reducing maximum TLS certificate validity to 200 days starting March 15, 2026.

NOTE: These changes apply to publicly trusted TLS certificates only.

Root Age-Based Trust Removal Timeline

Both Mozilla Firefox and Google Chrome will remove trust for TLS certificates chaining to roots older than 15 years. Trust removal is based on key material creation date, not revocation.

Root Key Material Created	Browser Trust Removed for TLS	Applicable GlobalSign Roots
Before 2006	April 15, 2025	GlobalSign Root R1 (Issuance is disabled)
2006 - 2007	April 15, 2026
2008 - 2009	April 15, 2027	GlobalSign Root R3*
20010 - 2011	April 15, 2028
2012 - April 14, 2014	April 15, 2029	GlobalSign Root R5 (ECC)
April 15, 2014 - present	15 years from creation	GlobalSign Root R6

* For Root R3, GlobalSign must stop issuing the 200-day TLS certificates by August 27, 2026  to ensure full browser trust for its entire lifetime.

Transition to TLS Dedicated Roots and Certificate Profiles

TLS dedicated roots.  are used only for publicly trusted TLS certificates. They are not shared with Secure Email, Code Signing, or other PKI use cases.

In 2019, GlobalSign proactively created two TLS-dedicated roots:

• R46 - RSA TLS Root

• E46 - ECC TLS Root

When issued from TLS-dedicated roots, TLS certificates must:

• Contain only the Server Authentication (ServerAuth) Extended Key Usage (EKU)

• Client Authentication (ClientAuth) and other EKUs will no longer be permitted

Chrome SCTNotAfter Constraint

Current GlobalSign roots (R3, R5, R6) are multi-purpose roots. Browser policies now require TLS issuance to be separated from other PKI use cases.

Google Chrome will apply an SCTNotAfter constraint to all GlobalSign multi-purpose roots:

• Effective date: September 13, 2026 (90 days after June 15, 2026)

• Certificates issued before this date will remain trusted for their full validity

• Certificates issued after this date will not be trusted by Google Chrome

What If You Need Client Authentication?

If you require TLS certificates with ClientAuth EKU or do not require browser trust, GlobalSign recommends using IntranetSSL, which offers:

• Longer certificate validity
• Longer domain reuse periods
• No CAA checking
• No Certificate Transparency (CT) logging (additional privacy)

What This Means for You

• If You Use Publicly Trusted TLS Certificates:

  • You will automatically transition to TLS-dedicated roots based on the timelines below

  • Shorter certificate lifetimes (200 days) will apply starting March 2026

  • Certificates with ClientAuth EKU will no longer be available from public TLS roots

• If You Do Not Require Browser Trust:

  • You may be allowed to remain on your current multi-purpose root configuration. Please contact your account manager or our support team to request this option for your Atlas profile.

  • Existing roots remain valid for non-TLS use cases i.e. for client authentication.

  • IntranetSSL may be a better long-term option.

GlobalSign Transition Plan

Atlas Customers

• July 8, 2025 (Q3 CA Rotation)

  • New CAs under TLS-dedicated roots will be created and made available for optional testing

  • Customers may test TLS-dedicated root issuance using test links on the GlobalSign Root Certificate support page

• July 27, 2026: All customer and partner products will move to TLS-dedicated roots

• September 13, 2026: Any remaining accounts that did not migrate in July will move to TLS-dedicated roots

• Cross-certification: GlobalSign will provide R3→R46 and R5→E46 cross-certificates to ensure maximum compatibility during transition

NOTE: Customers who do not require browser trust are encouraged to use IntranetSSL. You may be allowed to remain on your current multi-purpose root configuration. Please contact your account manager or our support team to request this option for your Atlas profile.

GCC Customers

See GCC - GlobalSign Transition Plan↗ for more information.