Sectigo New Public Roots and Issuing CAs Hierarchy [2025 Migration Guide]

Sectigo announces a 2025 migration to single‑purpose public roots and intermediates for TLS/SSL, S/MIME, and code signing to align with evolving browser and root program policies, reduce risk, and ensure long‑term trust. The report explains the new trust path (R46/E46 roots with R36/E36 intermediates and USERTrust cross‑signs), provides issuance cutover dates for EV (Apr 15, 2025), OV (May 15, 2025), DV (Jun 2, 2025), S/MIME (Mar 1, 2025), and phased code signing in 2025, and emphasizes a hard stop on reissuing under legacy chains after Jan 1, 2026. It offers practical deployment steps (install full chain, use CA bundles, verify with SSL checkers), Windows trust store remediation, and best practices to prevent trust breaks and service outages.