---
schema_version: "1"
id: 0dbf5f29006a1a39011767707db4bbde3243ada4daa75b27ae3d3f54b2865d45
title: Update Your mTLS Certificates
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/262-0-0/rn_general_mtls_certs.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_general_mtls_certs.htm&release=262.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 3eab8502e7308c2faa033aa7ceeeaf67e774508cb5c42a2d518b9cde732ff643
description: If you use publicly trusted certificates for mTLS (Mutual Transport Layer Security) and the Public Root CA (Certificate Authority) is in the Chrome Trusted Root List, transition to separate certificate hierarchies. Google Chrome is enforcing policy changes that limit the use of those certificates to only TLS (Transport Layer Security) server authentication.
products:
  - Cross Cloud
release: "262"
---
# Update Your mTLS Certificates

If you use publicly trusted certificates for mTLS (Mutual Transport Layer Security) and the Public Root CA (Certificate Authority) is in the Chrome Trusted Root List, transition to separate certificate hierarchies. Google Chrome is enforcing policy changes that limit the use of those certificates to only TLS (Transport Layer Security) server authentication.

**Where:** This change applies to [certificate-based authentication](https://help.salesforce.com/s/articleView?id=xcloud.security_certificate_based_auth.htm&type=5&language=en_US) and [API client certificates that enforce TLS mutual authentication](https://help.salesforce.com/s/articleView?id=xcloud.security_keys_uploading_mutual_auth_cert_api.htm&type=5&language=en_US) in Lightning Experience and Salesforce Classic. Certificate-based authentication is available in Personal, Enterprise, Performance, Unlimited, Developer, and Database.com editions.

**When:** Google Chrome enforces these policy changes on March 15, 2027. However, some customers have reported related issues upon certificate renewal.

**Why:** Google Chrome Root Program Policy v1.7 prevents the purchase and use of dual-use certificates that are issued by Public Root CAs in the Chrome Trusted Root List. The new policy requires dedicated Public Key Infrastructure (PKI) hierarchies for different certificate purposes. In other words, the policy separates certificates that identify websites (server authentication) from certificates that identify clients or users (client authentication).

**How:** Although Google is making this change, we’re announcing it here so that you can prevent disruption, including issues with access to Salesforce. Review the [Upcoming Mandatory Changes to Public Key Infrastructure (PKI)](https://help.salesforce.com/s/articleView?id=005237282&type=1&language=en_US) knowledge article and complete the recommended steps. That article includes the guidance that Salesforce can provide about this change.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-release-notes-salesforce_release_notes-262-0-0-production-enus/e945111b-3e0a-4011-accc-d5949363bfcc/images/icon_note.png)

Note Salesforce Customer Support can’t troubleshoot issues related to this change beyond sharing the information published in that knowledge article.

#### See Also

- [_Knowledge Article_: Upcoming Mandatory Changes to Public Key Infrastructure (PKI)](https://help.salesforce.com/s/articleView?id=005237282&type=1&language=en_US)