# Action Required: Losant’s Root Certificate is Changing **URL:** \ **Category:** Losant Announcements\ **Created:** [May 15, 2024, 6:19pm UTC](https://forums.losant.com/t/action-required-losant-s-root-certificate-is-changing/5474 "2024-05-15T18:19:18Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![Brandon\_Cannaday](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/brandon_cannaday/32/14_2.png) [@Brandon\_Cannaday](https://forums.losant.com/u/Brandon_Cannaday)\ **Post date:** [May 15, 2024, 6:19pm UTC](https://forums.losant.com/t/action-required-losant-s-root-certificate-is-changing/5474/1 "2024-05-15T18:19:18Z")
On February 11th, 2025, Losant is updating its root certificate. This update impacts devices that explicitly use the root certificate to verify TLS connections to the Losant platform. If your devices use root certificates to verify TLS connections and your devices do not contain the updated certificate, they will be unable to connect to the Losant platform after December 5th. **Edit: We have extended the deadline from December 5th February 11th, 2025 to give customers more time to update their devices.** For addition information and mitigation steps, please review the full blog article: > **[Action Required: Losant’s Root Certificate is Changing](https://www.losant.com/blog/action-required-losants-root-certificate-is-changing)** > > Losant is updating its root certificate. This impacts devices that explicitly use the root certificate to verify TLS connections to the Losant platform. ---
**Author:** ![Dylan\_Schuster](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/dylan_schuster/32/2850_2.png) [@Dylan\_Schuster](https://forums.losant.com/u/Dylan_Schuster)\ **Post date:** [May 22, 2024, 2:04pm UTC](https://forums.losant.com/t/action-required-losant-s-root-certificate-is-changing/5474/2 "2024-05-22T14:04:24Z")
If you would like to test your hardware to see if it can connect securely using the new root certificate, connect to our broker at **[broker-g2root.losant.com](http://broker-g2root.losant.com)**. This is only supported on port 8883 (`mqtts` protocol). If the device successfully establishes a secure connection at that host, then it will also succeed when we make the switch on [broker.losant.com](http://broker.losant.com) on August 1. Note that **[broker-g2root.losant.com](http://broker-g2root.losant.com)** is only available temporarily to allow our users to test their hardware against the upcoming root certificate change; you _should not_ utilize this endpoint for sustained device connections. ---
**Author:** ![Matt\_Eversole](https://avatars.discourse-cdn.com/v4/letter/m/c68b51/32.png) [@Matt\_Eversole](https://forums.losant.com/u/Matt_Eversole)\ **Post date:** [May 22, 2024, 2:20pm UTC](https://forums.losant.com/t/action-required-losant-s-root-certificate-is-changing/5474/3 "2024-05-22T14:20:29Z")
Why change the root certificate on August 1, 2024 when the trust of the current cert by Mozilla’s CA Certificate Program doesn’t expire until April 15, 2025? ---
**Author:** ![Dylan\_Schuster](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/dylan_schuster/32/2850_2.png) [@Dylan\_Schuster](https://forums.losant.com/u/Dylan_Schuster)\ **Post date:** [May 22, 2024, 2:56pm UTC](https://forums.losant.com/t/action-required-losant-s-root-certificate-is-changing/5474/4 "2024-05-22T14:56:35Z")
Losant’s current SSL certificates expire on Aug 9, 2024, and we will be renewing them using the new root certificate on Aug 1, 2024. ---
**Author:** ![Brandon\_Cannaday](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/brandon_cannaday/32/14_2.png) [@Brandon\_Cannaday](https://forums.losant.com/u/Brandon_Cannaday)\ **Post date:** [June 5, 2024, 5:53pm UTC](https://forums.losant.com/t/action-required-losant-s-root-certificate-is-changing/5474/5 "2024-06-05T17:53:27Z")
We have extended the deadline from August 1st to December 5th to give customers more time to update their devices. ---
**Author:** ![Chris\_GM](https://avatars.discourse-cdn.com/v4/letter/c/ac91a4/32.png) [@Chris\_GM](https://forums.losant.com/u/Chris_GM)\ **Post date:** [September 18, 2024, 7:29pm UTC](https://forums.losant.com/t/action-required-losant-s-root-certificate-is-changing/5474/6 "2024-09-18T19:29:53Z")
We have a number of devices which do not support two certificates. I have tested using the new cert, and temporary broker, and it works OK. How should I best manage the switchover. Is there a possibility of both certificates being accepted for a period of time, allowing us to switchover in a controller manner? ---
**Author:** ![Brandon\_Cannaday](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/brandon_cannaday/32/14_2.png) [@Brandon\_Cannaday](https://forums.losant.com/u/Brandon_Cannaday)\ **Post date:** [September 20, 2024, 3:47pm UTC](https://forums.losant.com/t/action-required-losant-s-root-certificate-is-changing/5474/7 "2024-09-20T15:47:02Z")
We’re looking into the possibility of bringing up another temporary endpoint that will remain on the old cert. This way you could switch to that endpoint now and remain connected after the production endpoint changes. You can then issue the required commands to switch the devices to the production endpoint with the updated certificate. ---
**Author:** ![ChrisGM](https://avatars.discourse-cdn.com/v4/letter/c/51bf81/32.png) [@ChrisGM](https://forums.losant.com/u/ChrisGM)\ **Post date:** [September 20, 2024, 4:01pm UTC](https://forums.losant.com/t/action-required-losant-s-root-certificate-is-changing/5474/8 "2024-09-20T16:01:19Z")
Thanks Brandon, Would you mind DM’ing me? ---
**Author:** ![Farhang\_Jalilian](https://avatars.discourse-cdn.com/v4/letter/f/aca169/32.png) [@Farhang\_Jalilian](https://forums.losant.com/u/Farhang_Jalilian)\ **Post date:** [October 10, 2024, 5:37pm UTC](https://forums.losant.com/t/action-required-losant-s-root-certificate-is-changing/5474/9 "2024-10-10T17:37:58Z")
The [blog post](https://www.losant.com/blog/action-required-losants-root-certificate-is-changing) is helpful thank you. Is there a possibility that the main MQTT broker ([broker.losant.com](http://broker.losant.com)) could accept both old and new certs for a period of time after Dec 5th? This will allow more time for systems that are **shipped but not been deployed** yet (and won’t be before Dec 5th) to get an update. As per current plan of hard cut-off Dec 5th, those systems will not get a chance to connect and receive the new cert because they’re on the old cert. Is the new root cert **currently** accepted on the main MQTT endpoint ([broker.losant.com](http://broker.losant.com))? If possible this will help us test our release candidate firmware (with old+new cert) against the main broker, as opposed to changing the endpoint to the test one just for the purpose of testing. In effect it’ll reduce our testing to half, because we can just test against the main MQTT broker as opposed to main+test MQTT brokers. ---
**Author:** ![Dylan\_Schuster](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/dylan_schuster/32/2850_2.png) [@Dylan\_Schuster](https://forums.losant.com/u/Dylan_Schuster)\ **Post date:** [October 10, 2024, 8:04pm UTC](https://forums.losant.com/t/action-required-losant-s-root-certificate-is-changing/5474/10 "2024-10-10T20:04:25Z")
> Is there a possibility that the main MQTT broker ([broker.losant.com](http://broker.losant.com/)) could accept both old and new certs for a period of time after Dec 5th? No, sorry; servers can only provide one certificate to the client at a time. > Is the new root cert **currently** accepted on the main MQTT endpoint ([broker.losant.com](http://broker.losant.com/))? The MQTT broker is currently using a certificate signed with the _old_ root cert. While that certificate is valid until August 2025, clients will stop trusting that certificate sometime in April 2025. We’ll be switching [broker.losant.com](http://broker.losant.com)’s certificate to one signed with the new root cert on December 5th, 2024. For testing purposes, we have another broker endpoint set up at [broker-g2root.losant.com](http://broker-g2root.losant.com/) and its SSL is signed using the _new_ root cert. ---
**Author:** ![Farhang\_Jalilian](https://avatars.discourse-cdn.com/v4/letter/f/aca169/32.png) [@Farhang\_Jalilian](https://forums.losant.com/u/Farhang_Jalilian)\ **Post date:** [October 11, 2024, 12:14am UTC](https://forums.losant.com/t/action-required-losant-s-root-certificate-is-changing/5474/11 "2024-10-11T00:14:50Z")
> [@Dylan\_Schuster](#): > > April 2025 If I am reading [this](https://knowledge.digicert.com/general-information/digicert-root-and-intermediate-ca-certificate-updates-2023#:~:text=G1-,DigiCert%20Global%20Root%20CA,-April%2015%2C%202026) correctly, the Mozilla distrust date is “April 15, 2026” for “DigiCert Global Root CA”. That doesn’t line up with either Aug 2025 or Apr 2025. ---
**Author:** ![Chris\_GM](https://avatars.discourse-cdn.com/v4/letter/c/ac91a4/32.png) [@Chris\_GM](https://forums.losant.com/u/Chris_GM)\ **Post date:** [October 22, 2024, 4:35pm UTC](https://forums.losant.com/t/action-required-losant-s-root-certificate-is-changing/5474/12 "2024-10-22T16:35:14Z")
For those interested, we have merged the old and new certificates together, and both the existing broker and test broker accept the new modified certificate. ---
**Author:** ![Farhang\_Jalilian](https://avatars.discourse-cdn.com/v4/letter/f/aca169/32.png) [@Farhang\_Jalilian](https://forums.losant.com/u/Farhang_Jalilian)\ **Post date:** [December 5, 2024, 2:12am UTC](https://forums.losant.com/t/action-required-losant-s-root-certificate-is-changing/5474/13 "2024-12-05T02:12:08Z")
What UTC timestamp (approximate is OK) did the cert get updated at? ---
**Author:** ![Brandon\_Cannaday](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/brandon_cannaday/32/14_2.png) [@Brandon\_Cannaday](https://forums.losant.com/u/Brandon_Cannaday)\ **Post date:** [December 5, 2024, 3:34pm UTC](https://forums.losant.com/t/action-required-losant-s-root-certificate-is-changing/5474/14 "2024-12-05T15:34:10Z")
We pushed the update back to **Feb 11th**. Some customers required a bit more time to update their devices. I do realize we failed to send that update. Apologies for the last-minute notice. ---
**Author:** ![Farhang\_Jalilian](https://avatars.discourse-cdn.com/v4/letter/f/aca169/32.png) [@Farhang\_Jalilian](https://forums.losant.com/u/Farhang_Jalilian)\ **Post date:** [February 12, 2025, 5:19pm UTC](https://forums.losant.com/t/action-required-losant-s-root-certificate-is-changing/5474/15 "2025-02-12T17:19:13Z")
@Brandon_Cannaday today Feb 12th - any updates? what timestamp was the cert updated at? (or possibly reverted) UPDATE I found my answer here: [https://status.losant.com/](https://status.losant.com/) ---
**Author:** ![Brandon\_Cannaday](https://sea1.discourse-cdn.com/flex015/user_avatar/forums.losant.com/brandon_cannaday/32/14_2.png) [@Brandon\_Cannaday](https://forums.losant.com/u/Brandon_Cannaday)\ **Post date:** [February 12, 2025, 5:23pm UTC](https://forums.losant.com/t/action-required-losant-s-root-certificate-is-changing/5474/16 "2025-02-12T17:23:10Z")
The Status Page is a good place to monitor. I also posted a forum topic that I will keep updated. > [@Root Certificate Update Temporarily Delayed](https://forums.losant.com/t/root-certificate-update-temporarily-delayed/5766): > > Updating a root certificate can be quite impactful, especially for fielded devices. During today’s scheduled update, the root certificate for the platform was changed. We were pleased to see that the vast majority of devices did successfully reconnect, however a critical handful did not. This is something we did anticipate and we fully expected to roll back the update once it went live as customers discovered their devices did not correctly support the new certificate. We will not be delaying…