Peppol PKI certificates must be replaced by April 2026
OpenPeppol has announced that all Peppol PKI certificates must migrate to Generation 3 (G3) by April 1, 2026, due to a platform change at DigiCert. Support for both G2 and G3 root certificates is required from February 11, 2026.
OpenPeppol has announced a mandatory migration of Peppol PKI certificates from Generation 2 (G2) to Generation 3 (G3) due to a platform change at certificate provider DigiCert. All Access Points and SMPs must complete the migration by April 1, 2026.
OpenPeppol has announced that existing Peppol PKI certificates will become invalid due to a platform change at certificate provider DigiCert. All Access Points and Service Message Points (SMPs) must migrate to Generation 3 (G3) certificates by April 1, 2026.
Migration timeline
The transition period runs from February 11 to April 1, 2026. From February 11 onwards, both the existing G2 root certificate and the new G3 root certificate must be supported in configuration and software. The actual replacement of production certificates can occur at any point during this window.
What service providers must do
The Dutch Peppol Authority urges all Dutch service providers to:
- Review the OpenPeppol migration documentation without delay
- Plan and schedule the necessary migration steps
- Ensure both G2 and G3 root certificates are supported in their systems from February 11
- Complete the certificate replacement before the April 1 deadline
Detailed migration guidance is available in the OpenPeppol documentation at https://openpeppol.atlassian.net/wiki/spaces/OPMA/pages/4446552067/Peppol+PKI+Migration+2025-2026