In our recent incident, 2026.05.08 Gen Y Cross-Certified Subordinate CAs missing serverAuth EKU, we identified a problem with our cross-signed CA certificates. To minimize any potential for disruption, we delayed switching the classic profile to the Y hierarchy and switched our tlsserver and shortlived profiles back to our previous intermediates. We have issued new cross-signed certificates which contain corrected Extended Key Usage fields, and are prepared to move forward.
Today, we will be switching tlserver and shortlived profiles to the intermediates YE1, YE2, YR1, YR2. We will switch the classic profile to these new intermediates in one week from now, on 2026-05-27.