Microsoft announced that it will begin removing trust in eMudhra root certificates on November 16, 2026. Existing certificates may stop working as early as Monday morning, even if they have not expired.

Deadline: Sunday, November 15, 2026. All eMudhra-issued SSL certificates must be replaced by the end of Sunday, November 15, regardless of their expiration dates. We strongly encourage administrators to complete replacements before the end of the business day on Friday, November 13.

Which Certificates Need to Be Replaced?

Action required: eMudhra. All certificates must be replaced immediately, regardless of expiration date.

No action required:

• Sectigo. These certificates can be replaced on their normal renewal schedule.
• SSL.com / CERTInext
• Amazon, Let’s Encrypt, and other external certificate authorities

Replacement Instructions

IDM has successfully tested and developed procedures for certificate updates. Follow the instructions below that match how your certificate is managed.

1. Certificates Managed Through Cornell’s ACME Proxy

If your certificates are managed automatically through Cornell’s ACME Proxy, force a renewal using your existing ACME client.

Linux (Certbot):

sudo certbot renew --cert-name myCertName --force-renewal

Replace myCertName with your certificate’s name. You can list your configured certificates using sudo certbot certificates.

Windows (win-acme):

wacs.exe --renew --force --verbose

The proxy now obtains certificates from SSL.com. If your ACME client is configured correctly, the renewal process should automatically install the new certificates and update their certificate chains.

Depending on your configuration, you may need to restart or reload your web server or other service for the new certificate to take effect.

Verify that the new certificate and certificate chain have been deployed successfully and that your service is using them.

ACME Proxy documentation:

• Windows: Using ACME Proxy for Certificate Management on Windows
• Linux: Using ACME Proxy for Certificate Management on Linux

2. Certificates Requested Manually Through ssl.cit.cornell.edu

If you obtained your certificate through Cornell’s SSL certificate request website:

1. Generate a new Certificate Signing Request (CSR).
2. Visit ssl.cit.cornell.edu and submit a new certificate request using the new CSR.
3. Once the certificate is issued, you will receive an email containing a link to download the new certificate and certificate chain.
4. Install the new certificate and update your certificate chain configuration to use the new intermediate certificates provided by SSL.com.

Important: The new certificates use a different certificate chain. Simply replacing the server certificate without updating its chain may result in certificate validation failures.

3. Certificates for Domains Outside cornell.edu

All cornell.edu domains and subdomains have been validated with SSL.com and are ready for certificate issuance.

IDM has contacted the owners of domains outside cornell.edu that require additional validation. If you manage certificates for one of these domains and have not received a communication from IDM, please contact idmgmt@cornell.edu immediately.

4. Custom Certificate Configurations

If your systems use custom certificate chains, trust stores, or other certificate-related configurations, you must update those configurations as necessary to support the new certificates.

Verify Your Replacements

After replacing a certificate, verify that the new certificate is installed, the appropriate certificate chain is configured, and the service is functioning correctly.

Contact

If you have a specific concern, please send email to idmgmt@cornell.edu.