In Q2 2026, to improve efficiency, we will be updating the Transport Layer Security (TLS) certificate for many Google endpoints. The intermediate
Certificate Authority (CA) and certificate type will shift from a RSA certificate chain and leaf certificate to an ECDSA certificate.
What you need to know
Key changes:
Many services, including googleapis.com, will shift to using the Google Trust Services WE1 intermediate and ECDSA based TLS certificates.
Potential impact:
If your client applications are not configured correctly, they may be unable to connect to Google services after this change. Connection failures are
most likely to occur in the following two scenarios:
Certificate pinning: [Does not affect XMB] We do not recommend pinning intermediate or leaf certificates. This practice
will cause your application to break during routine certificate rotations.
Custom trust stores: [Does affect XMB] If you use a custom trust store, you must ensure it includes all of Google Trust Services (GTS) Root
CAs to prevent outages. For most customers, no action is required as a result of this change. However, if you run a custom trust store or pin CAs,
you may need to take action. |