Background

According to Mozilla's updated Root Certificate Trust Policy, root certificates used for server identity verification will no longer be trusted if they were issued more than 15 years ago. As a result, major browsers such as Mozilla Firefox and Google Chrome will no longer trust root certificates issued over 15 years ago. Websites using legacy GlobalSign root certificates (R1/R3/R5/R6) may trigger security warnings or become inaccessible in these browsers, directly impacting user experience and business continuity.

Upgrade Details

To ensure ongoing TLS communication security and certificate validity, starting from July 21, 2026 (UTC+8), MQTT server-side certificates will be progressively upgraded from the GlobalSign R1/R3 certificate chain to the GlobalSign R1/R46 certificate chain before the current certificates expire.

Certificate Chain Changes

Before upgrade:

*.mqtt.aliyuncs.com
  → GlobalSign GCC R3 OV TLS CA 2024
  → GlobalSign Root CA - R3
  → GlobalSign Root CA R1 (cross-signed)

After upgrade:

*.mqtt.aliyuncs.com
  → GlobalSign GCC R46 OV TLS CA 2025
  → GlobalSign Root R46
  → GlobalSign Root CA R1 (cross-signed)

Impact

Important: The GlobalSign Root CA R1 certificate, which is retained for backward compatibility with legacy clients, will expire on January 28, 2028.
If your client only trusts R1 and does not have GlobalSign Root R46 built in or explicitly trusted, you may experience TLS handshake failures or untrusted certificate chain errors in the future.
We recommend that affected users complete the following checks in advance:

• Upgrade the client operating system, JDK, OpenSSL, or CA trust store.
• Verify that your client trusts GlobalSign Root R46.
• For clients using stripped-down CA bundles, IoT devices, or custom certificate stores, pre-install the R46 root certificate and perform connection validation.

This upgrade does not change MQTT access domains or ports. Please complete client compatibility verification ahead of time to avoid connection issues caused by the certificate chain transition or the eventual expiration of the R1 certificate.