InCommon’s November 12, 2026 update confirms that certificate issuance has moved from emSign to SSL.com. CERTInext remains the management platform. InCommon asks subscribers to replace affected certificates by the end of November 16.
The update says domain-validated issuance began November 9; organization-validated issuance follows completion of organization validation. A working portal therefore does not mean every replacement order is immediately ready.
A planning deadline, not one universal outage
This recommendation is not a claim that every certificate fails everywhere on November 16. Trust behavior differs across client platforms and certificate issue dates. Use the current service notice for the affected population, rather than applying this date to unrelated certificates.
Close the gap between issuance and deployment
Our suggested operational checklist starts with the service, not the download button:
- Assign each affected endpoint an owner. Record its certificate identifiers and the applications that depend on it. Include machine-to-machine clients, not just browsers.
- Confirm order readiness. Establish whether validation is complete and whether the replacement covers the required names. Escalate a blocked order through the provider’s established support route.
- Verify deployment. Check the chain actually presented by the endpoint and test with representative clients. A replacement file stored in the portal is not evidence that a load balancer or application is serving it.
- Retain security checks. Do not solve a trust failure by disabling certificate validation. Keep private keys out of support messages and retain a change record showing what was replaced.
The transition announcement gives subscribers a replacement route. The remaining operational work is to connect that route to a verified deployment before the service’s recommended date. We have not tested subscriber systems; the checklist is guidance, not a report of completed remediation.