Additional Actions May Be Needed for InCommon Certificates by Oct. 27

This message is intended for U-M IT staff who are responsible for managing certificates for university websites or systems.

Summary

This is a follow-up to two previous alerts regarding an industry-wide certificate authority issue that may affect access to some University of Michigan websites and services. In addition to replacing affected certificates by October 27, additional important steps may be needed regarding trusting certificate authorities in order to avoid disruptions.

Please refer to the previous alerts and the ITS Service Status page for background and important guidance:

Problem

Once InCommon/CERTInext certificates are replaced, using the steps provided on the ITS Service Status page under Technical Details, additional steps may be required. Specifically, after replacement, additional testing of your services will be needed, and new root certificates may need to be trusted. Broad removals of the impacted root certificates from mainstream applications and services are expected to roll out starting October 27th, 2026.

Action Items

  • Because various U-M services will be migrating to a new certificate chain, systems may need to be updated to trust the alternate root.
    • emSign Root TLS CA - G1
  • Beginning Oct. 27, due to the risk, the currently affected G3 certificate should be distrusted; remove it from any certificate chain, and either upgrade your trust stores or manually remove the affected G3 certificate from the trust store.
    • emSign Root TLS CA - G3
  • As browsers, operating systems, and other software receive updates, affected root certificates will be distrusted.
  • Test your systems after changes as certificate migrations will be an ongoing process.
  • You may get errors if it’s a service that hasn’t been updated.

Support Resources

  • Office Hours Available: for technical assistance with administering InCommon certificates
  • Refer to this Knowledge Base article.

Information for Users

Some university websites and applications may become unavailable to visitors.

Questions, Concerns, Reports

If you have questions or need assistance, send a request to [email protected].

References