---
schema_version: "1"
id: 185c3e005822f842102db753db5add2046be8e199cf0e21f00e5125675d1a923
title: Update Your mTLS Certificates
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/260-0-0/rn_general_mtls_certs.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_general_mtls_certs.htm&release=260&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: b356ed6a0de804cb5f61d649fe0bb43f3c65d5ef8c1d1f933216819df9171b45
description: If you use publicly trusted certificates for mTLS (Mutual Transport Layer Security) and the Public Root CA (certificate authority) is in the Chrome Trusted Root List, transition to separate certificate hierarchies. Google Chrome is enforcing policy changes that limit the use of those certificates to TLS (Transport Layer Security) server authentication only.
products:
  - Cross Cloud Packages Solutions
release: "260"
---
# Update Your mTLS Certificates

If you use publicly trusted certificates for mTLS (Mutual Transport Layer Security) and the Public Root CA (certificate authority) is in the Chrome Trusted Root List, transition to separate certificate hierarchies. Google Chrome is enforcing policy changes that limit the use of those certificates to TLS (Transport Layer Security) server authentication only.

**Where:** This change applies to [certificate-based authentication](https://help.salesforce.com/s/articleView?id=xcloud.security_certificate_based_auth.htm&type=5&language=en_US) and [API client certificates that enforce TLS mutual authentication](https://help.salesforce.com/s/articleView?id=xcloud.security_keys_uploading_mutual_auth_cert_api.htm&type=5&language=en_US) in Lightning Experience and Salesforce Classic. Certificate-based authentication is available in Personal, Enterprise, Performance, Unlimited, Developer, and Database.com editions.

**When:** Google Chrome enforces these policy changes on March 15, 2027. However, some customers have reported related issues upon certificate renewal.

**Why:** Google Chrome Root Program Policy v1.7 prevents the purchase and use of dual-use certificates that are issued by Public Root CAs in the Chrome Trusted Root List. The new policy requires dedicated Public Key Infrastructure (PKI) hierarchies for different certificate purposes. In other words, the policy separates certificates that identify websites (Server Authentication) from certificates that identify clients or users (Client Authentication).

**How:** Although Google is making this change, we’re announcing it here so that you can prevent disruption, including issues with access to Salesforce. Review the [Upcoming Mandatory Changes to Public Key Infrastructure (PKI)](https://help.salesforce.com/s/articleView?id=005237282&type=1&language=en_US) knowledge article and complete the recommended steps. That article includes the guidance that Salesforce can provide about this change.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-salesforce_release_notes-260-0-0-production-enus/ba62a63b-6cd1-440e-8d24-e867afab0363/images/icon_note.png)

Note Salesforce Customer Support can’t troubleshoot issues related to this change beyond sharing the information published in that knowledge article.

#### See Also

- [_Knowledge Article_: Upcoming Mandatory Changes to Public Key Infrastructure (PKI)](https://help.salesforce.com/s/articleView?id=005237282&type=1&language=en_US)