Any certificate renewal can change your issuer

Your site can serve a certificate from a different issuer after a renewal, with nobody on your team involved. The change may come from your provider's choice of certificate authority (CA), or from your name pointing at a different provider. Only you can tell which.

If a content delivery network (CDN) or hosting platform manages your certificate, it may choose the CA too. Cloudflare chooses the CA for its Universal certificates.

Renewals are becoming more frequent. The CA/Browser Forum adopted ballot SC-081v3 in April 2025, and the Baseline Requirements, section 6.3.2, now cap a public Transport Layer Security (TLS) certificate at 200 days from March 15, 2026, 100 days from March 15, 2027, and 47 days from March 15, 2029. On February 10, 2027, Let's Encrypt moves every subscriber to 64-day certificates by default, down from 90. Let's Encrypt announced the date on October 7, 2026.

How Netonica records an issuer change

Our TLS check keeps these changes in your history so you can compare what your site served before and after a renewal. A renewal from a different CA appears as "Issuing CA changed". The diff shows the previous issuer, the new issuer, and each certificate's dates.

Issuing CA changed
Let's Encrypt → Google Trust Services

            before                  after
issuer      Let's Encrypt           Google Trust Services
not_before  2026-07-04T00:00:00Z    2026-09-18T00:00:00Z
not_after   2026-10-02T00:00:00Z    2026-12-17T00:00:00Z

We alert only when an assertion you've ticked breaks or recovers. Issuing CA unchanged needs a saved issuer. Pin the one from your first scan (see how pins work). Once you pin it, a renewal from another CA breaks Issuing CA unchanged. Until you pin, a CA change by itself raises no alert and goes into the history.

The pin compares the organization in the certificate's issuer field. A move to another intermediate certificate from the same CA doesn't break it.

We see the certificate your site serves when we connect. A certificate someone obtained for your name and never served won't show up here.

If you're happy with any CA your CDN picks, untick Issuing CA unchanged; renewals still appear in the history.