Important Notice: Mandatory Migration to ChromeOS Certificate Provisioning API
Action Required for IT Administrators
Please be advised that at the end of November 2026, ChromeOS will officially end support for certificate enrollment workflows that do not utilize the Certificate Provisioning API. After this deadline, no new certificates will be issued, and certificate renewals without the Certificate Provisioning API will fail.
To prevent service disruptions and ensure continuous network and resource access for your enterprise fleets, IT administrators must transition to the Certificate Provisioning API standard prior to November 2026.
Timeline & Impact
| Milestone | Date | Operational Impact |
|---|---|---|
| Migration Window | Ongoing – Nov 2026 | IT administrators should test and deploy the Certificate Provisioning API across all organizational units. |
| Deprecation Deadline | End of November 2026 | Support for legacy certificate enrollment ends. Unmigrated devices will be unable to receive new or renewed certificates. |
Guidance & Migration Resources
To assist your organization with a smooth transition, comprehensive configuration documentation and dedicated support channels are available:
- Migration Steps: For step-by-step setup on how to migrate from SCEP to Certificate Provisioning API while maintaining feature parity, check out the Dedicated Help Center Article.
- Full Configuration Instructions: Deep dive into the setup and deployment details covering all new features of the Certificate Provisioning API here in the Configuration Guide.
- Community Discussion: Feel free to respond here with any general questions or comments on this upcoming change.
Recommended Action Plan
- Review existing SCEP profiles and client certificate deployment methods in your Google Admin console.
- Deploy test certificates using the new API in a staging organizational unit (OU).
- Complete full fleet migration well before the November 2026 deadline.
