Sep 5, 2023 — Basic Constraints extension for Organization-validated and Extended-validated certificates

Update to the Basic Constraints extension for Organization-validated and Extended-validated certificates

Starting Sep. 5, 2023 all Akamai-managed OV and EV certificates issued by DigiCert, including GeoTrust certificates, will be issued by DigiCert with the Basic Constraints extension set to "critical" by default. Connecting TLS clients must accept this extension. This change to the Basic Constraints extension is required by industry standards for issuance of public TLS certificates. Traffic from most TLS clients, such as web browsers and mobile devices, will not be affected by this change. No action is required.

Existing certificates are also unaffected by this change and may be used until expiration. At the next certificate modification or renewal after Sep. 5, 2023 the newly issues certificate will be issued with the Basic Constrains extension set to "critical".

If you have a need for certificates without their Basic Constrains extension set to "critical," for example to service non-standard TLS clients, provision a third-party certificate in CPS and obtain a new certificate from a certificate authority of your choice.