If you use publicly trusted certificates for mTLS (Mutual Transport Layer Security) and the Public Root CA (certificate authority) is in the Chrome Trusted Root List, transition to separate certificate hierarchies. Google Chrome is enforcing policy changes that limit the use of those certificates to TLS (Transport Layer Security) server authentication only.
Where: This change applies to certificate-based authentication and API client certificates that enforce TLS mutual authentication in Lightning Experience and Salesforce Classic. Certificate-based authentication is available in Personal, Enterprise, Performance, Unlimited, Developer, and Database.com editions.
When: Google Chrome enforces these policy changes on March 15, 2027. However, some customers have reported related issues upon certificate renewal.
Why: Google Chrome Root Program Policy v1.7 prevents the purchase and use of dual-use certificates that are issued by Public Root CAs in the Chrome Trusted Root List. The new policy requires dedicated Public Key Infrastructure (PKI) hierarchies for different certificate purposes. In other words, the policy separates certificates that identify websites (Server Authentication) from certificates that identify clients or users (Client Authentication).
How: Although Google is making this change, we’re announcing it here so that you can prevent disruption, including issues with access to Salesforce. Review the Upcoming Mandatory Changes to Public Key Infrastructure (PKI) knowledge article and complete the recommended steps. That article includes the guidance that Salesforce can provide about this change.
