SSL/TLS Certificate - InCommon Certificate Service Vendor Transition (Sectigo → CERTInext)
Transition completion date: July 17, 2026
Additional information is available from InCommon:
- https://incommon.org/certificate-service-transition
- https://spaces.at.internet2.edu/spaces/CERTSVC/pages/388300988/Certificate+Service+Home
This service issued approximately 2,000 server certificates last year via https://servercertificates.wisc.edu through the vendor Sectigo and after July 17th, 2026, CERTInext.
Here is a highlight of what will remain the same, what is changing, and steps going forward:
Existing Certificates
Existing Certificates already issued will continue to be valid until their expiration date. (Yes, this means you can renew certs right up until the transition date, probably 7/16 to be safe)
Pricing
Continued service and support for SSL/TLS certificates for servers to the UW-Community at no charge.
Code Signing certificates are not cost covered, and will be available as a purchased add-on. We are awaiting pricing for this.
Client certificates will not covered, and of note - current certificates can be used for client authentication, but that extended usage is going away soon across the industry.
Manual certificate issuance
Continued support via https://servercertificates.wisc.edu that will require moderate development work from our team to integrate with CertiNext’s new API.
We encourage you to automate, that said not all applications or vendors support native certificate automation and as a result, there will be increased administrative burden with industry standard shortened certificate lifespans.
ACME-issued certificates
Continued support for automated ACME issuance but requires minimal changes for existing customers (updating a single URL and credentials)
IGTF certificates
Continued support for academic grid computing
Known Changes
- Due to a Google Chrome push related to intermediate Certificate Authorities, max cert lifespan will be 90 days as of December 31st, 2026
- Code signing certificates will no longer be free, but we do not yet have pricing
- More protocols will be available for free: SCEP, EST, CMP, & WAEP
Feature Availability
- CERTInext is expected to offer more features than the current service.
- Some features may be offered as à la carte add-ons.
- At this time we do not have a a complete list of features or options available.
Next Steps
Contract Review: DoIT Purchasing currently has the new agreement. They are reviewing it and comparing it to our previous agreement. We expect the agreement to be virtually identical, but we are prepared to negotiate terms if necessary.
User Communication: Our team has assembled a contact list of email addresses that have received certificates over the past year. We will communicate important transition information to the list and maintain updates to this KB document.
Questions? servercertificates@doit.wisc.edu