SSL Chain Check: AIA Is Now Optional and DigiCert Switches to G5 Roots on Nov 12

أكتوبر 20, 2026

0

Two certificate changes landed in the past few weeks that point to the same boring but important habit: install the full certificate chain on your server, not just your own certificate. One is a rule change from the CA/Browser Forum that lets certificate authorities stop including a field browsers use to patch up broken chains. The other is DigiCert moving its certificates to new root certificates on November 12. Neither will break a properly set up site, but both can catch out servers that have been getting away with a half-installed SSL certificate.

What happened

Every SSL/TLS certificate links to a trusted root through one or more intermediate certificates. Your server is supposed to send your certificate plus those intermediates. Many servers only send the site certificate, and things still work in Chrome, Edge and Safari because those browsers read a field in the certificate called Authority Information Access (AIA). It contains a web address where the browser can download the missing intermediate and fix the chain itself.

The CA/Browser Forum, the group of certificate authorities and browser makers that sets the rules, passed ballot SC104 with no votes against. It changes AIA in website certificates from "MUST" to "SHOULD", which means a CA is now allowed to leave it out. The ballot's review period ended on October 3, 2026, and WebPixie reports it took effect on October 4 in version 2.3.1 of the Baseline Requirements.

Separately, DigiCert says that starting November 12, 2026, it will issue public TLS certificates from its newer "G5" roots by default. It originally planned this for October 15 and postponed it. This covers new orders, renewals and reissues, and all its brands, including GeoTrust, Thawte, RapidSSL and Encryption Everywhere. DigiCert says the reason is that Chrome is limiting each CA to two active TLS roots from September 15, 2027, and only its two G5 TLS roots will be supported then.

Who is affected

Nothing breaks today because of the AIA change. WebPixie notes that no CA has announced it will drop AIA, and the certificates it checked from Let's Encrypt, Google, DigiCert and Sectigo still include it. The risk is for servers that send an incomplete chain. If a CA later drops AIA, Chrome, Edge and Safari lose their way to repair the chain and visitors can see a certificate error. Firefox on desktop would keep working, because it preloads intermediates instead, so "works in Firefox, fails in Chrome" may become a new symptom of a missing intermediate.

For DigiCert customers, the company says most people need to do nothing as long as they install the full chain it provides. You are more at risk if you only install the site certificate, manage your own trust store, or pin or hard-code root or intermediate certificates in apps or devices. Separately, DigiCert says it will remove the Client Authentication setting from its public TLS certificates on March 1, 2027, which only matters if you use them for mutual TLS or server-to-server logins.

What you should do

Check what your server actually sends. Run openssl s_client -connect yoursite.com:443 -servername yoursite.com -showcerts and make sure you see your certificate plus at least one intermediate, with "Verify return code: 0 (ok)". Online SSL checkers can show this too.
If only one certificate shows up, install the full chain. For Let's Encrypt this is usually fullchain.pem rather than cert.pem. For a paid certificate, install the CA bundle file that came with it. In cPanel, paste the CA bundle in the box provided.
Check every server behind your domain, including load balancers and CDNs, since one node can be set up differently from the rest.
Do not use Firefox as your only test. It can hide chain problems that Chrome and Safari users would hit.
If you use DigiCert or one of its brands, plan to check your chain after your first renewal or reissue on or after November 12, 2026.
Remove any certificate pinning or hard-coded roots in apps, devices or API clients. DigiCert advises against it, because roots and intermediates now change more often.

The bigger lesson

Certificate lifetimes are getting shorter and roots are rotating faster, so you will be renewing and reinstalling certificates more often than before. Automate renewals where you can, make sure the automation installs the full chain, and add a monitor that checks the chain the way a strict client does. A five-minute check now can save you a confusing outage later.