Skip to content

Commit 6d434d9

Browse files
authored
Update latest blog post (#2078)
s/week/month/, as changed in draft but not propagated to PR
1 parent 8d5160c commit 6d434d9

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

content/en/post/2025-11-24-gen-y-hierarchy.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,6 @@ The [six new intermediates](/certificates/#subordinate-intermediate-cas) consist
2222

2323
Second and more importantly: these intermediates do not contain the “TLS Web Client Authentication” Extended Key Usage. This means that these intermediates cannot issue end-entity certificates containing that EKU. As we’ve [already announced](/2025/05/14/ending-tls-client-authentication), we will be phasing out issuance of tlsClientAuth certificates in 2026 due to a root program requirement. Until that time, we will only be using the new hierarchy to issue certificates under the “[tlsserver](https://letsencrypt.org/docs/profiles/#tlsserver)” and “[shortlived](https://letsencrypt.org/docs/profiles/#shortlived)” profiles, which already omit that EKU. After the tlsClientAuth deprecation is complete, we will shift to using the new intermediates for all issuance.
2424

25-
If you’re requesting the tlsserver or shortlived profile, you can expect to see issuance from (the [Staging equivalent](/docs/staging-environment/) of) the new hierarchy as of today. We expect to make the same change in our Production environment next week. As before, each issuance will choose which intermediate to use at random, to [discourage intermediate key pinning](https://letsencrypt.org/2024/03/19/new-intermediate-certificates#rotating-issuance).
25+
If you’re requesting the tlsserver or shortlived profile, you can expect to see issuance from (the [Staging equivalent](/docs/staging-environment/) of) the new hierarchy as of today. We expect to make the same change in our Production environment next month. As before, each issuance will choose which intermediate to use at random, to [discourage intermediate key pinning](https://letsencrypt.org/2024/03/19/new-intermediate-certificates#rotating-issuance).
2626

2727
We’ll be submitting the new roots for inclusion in the Apple, Chrome, Microsoft, Mozilla, and other root programs shortly thereafter. We look forward to updating you again when the new hierarchy is officially included in those trust stores!

0 commit comments

Comments
 (0)