Update: Additional Actions Needed for InCommon Certificates by Nov. 16

This message is intended for U-M IT staff who are responsible for managing certificates for university websites or systems.

Update, November 11, 2026

Several major vendors have begun removing trust for all eMudhra-issued certificates, with Microsoft scheduled to do so on Monday, November 16, 2026 and Apple on Monday, November 30, 2026. To avoid service interruptions, all previously issued InCommon eMudhra certificates must be replaced.

InCommon has selected SSL.com as their new certificate provider. ITS is converting existing CERTInext ACME credentials to issue SSL.com CA certificates versus eMudhra certificates on Wednesday, November 11, 2026 at 12:00 p.m. 

Campus IT staff that use InCommon certificates have received instructions to replace impacted certificates.

Additional updates will continue to be provided through the ITS Service Status page.

Update, October 26, 2026

Out of an abundance of caution, we want to make you aware there is at least one vendor (Oracle) who has begun removing G1 certificates. Before applying any vendor application patches, please be aware that the removal of the certificates may cause a break in service. Please perform testing in a non-production environment once the patches are applied before deploying to production.

Take Action Now
     --   Replace affected ECC certificates issued through InCommon/CERTInext.
     --   In order to avoid service interruptions, perform daily testing after replacing certificates as patches are released on a rolling basis.

In addition to replacing affected certificates, administrators may need to take further steps to ensure their systems trust the appropriate certificate authorities. This includes verifying that services recognize the new certificate chain and updating certificate trust settings as necessary.

Summary

This is a follow-up to two previous alerts regarding an industry-wide certificate authority issue that may affect access to some University of Michigan websites and services. In addition to replacing affected certificates by October 27, additional important steps may be needed regarding trusting certificate authorities in order to avoid disruptions.

Please refer to the previous alerts and the ITS Service Status page for background and important guidance:

Problem

Once InCommon/CERTInext certificates are replaced, using the steps provided on the ITS Service Status page under Technical Details, additional steps may be required. Specifically, after replacement, additional testing of your services will be needed, and new root certificates may need to be trusted. Broad removals of the impacted root certificates from mainstream applications and services are expected to roll out starting October 27th, 2026.

Action Items

  • Because various U-M services will be migrating to a new certificate chain, systems may need to be updated to trust the alternate root.
    • emSign Root TLS CA - G1
  • Beginning Oct. 27, due to the risk, the currently affected G3 certificate should be distrusted; remove it from any certificate chain, and either upgrade your trust stores or manually remove the affected G3 certificate from the trust store.
    • emSign Root TLS CA - G3
  • As browsers, operating systems, and other software receive updates, affected root certificates will be distrusted.
  • Test your systems after changes as certificate migrations will be an ongoing process.
  • You may get errors if it’s a service that hasn’t been updated.

Support Resources

  • Office Hours Available: for technical assistance with administering InCommon certificates
  • Refer to this Knowledge Base article.

Information for Users

Some university websites and applications may become unavailable to visitors.

Questions, Concerns, Reports

If you have questions or need assistance, send a request to [email protected].

References