2026-07-09T17:47:00.0000000Z

Overview:

InCommon has made recent changes to server certificates that have affected some TSE clients. Additional changes are coming soon that will affect all TSE clients that use InCommon certificates and still use legacy devices.

GoDaddy has also made changes to its SSL certificates that will require a manual workaround for legacy devices.

Current State (new InCommon certificates obtained in past couple months through ~ July 17, 2026):

InCommon made a short-lived change to the root certificate used to generate server certificates starting earlier this year up through approximately July 17, 2026. Many older embedded devices (across all industries, not limited to Illumia) do not contain this root certificate, preventing them from establishing TLS connections. They provided a workaround to “cross-sign” those new certificates back to the previously used root certificate.

Over the last couple of months, Illumia has assisted several clients in reconfiguring their newly acquired InCommon certificates to leverage this cross-signing. Please reach out to support if you plan to update your InCommon certificates between now and July 17, 2026, to ensure that the manual steps are completed as needed.

Next State (new InCommon certificates obtained after ~ July 17, 2026):

InCommon is making another transition between now and July 17, 2026, to a different root certificate. This new root certificate will not support the cross-signing as described above.

We expect newer supported devices (PR5000 and Verify in particular) to have no issues with these new certificates. We are actively preparing to test this as soon as possible.

Older legacy devices (SA3032, MF4100, VR4100/VR4101, AC3100, LC3000, VR-MDBMP) will not work with these new InCommon certificates because they do not contain the new root certificate that will be used. Note that all these devices are past the End of Support date except for SA3032 (with an official End of Support date of June 30, 2026).

Options after ~ July 17, 2026:

Option 1 – obtain GoDaddy certificate:

All of the affected legacy devices listed above can still be used if you obtain a GoDaddy certificate instead of InCommon.

Option 2 – upgrade TSE to continue support of some legacy devices:

Illumia is expediting a TSE update that will include firmware updates for SA3032, MF4100, and VR4100/VR4101 to allow them to continue to work with the next version of InCommon certificates. Note that we will not be updating AC3100, LC3000, or VR-MDBMP.

This update will be available by approximately June 30, 2026. We want to prioritize upgrading TSE clients based on when their existing InCommon certificate expires. We expect a high volume of upgrade requests.

The sequence of this TSE update will generally be:

• Perform TSE update.
• Bring all SA3032, MF4100, VR4100/VR4101 online to get the firmware update – this includes any spares you may want to use in the future.
• After all legacy devices are confirmed updated, obtain your next InCommon certificate in advance of your existing one expiring.

About this Update:

Illumia has decided to invest the development resources to provide this TSE update to allow our valued clients to continue to use legacy devices beyond their advertised End of Support dates.

These devices have provided our clients with many years (decades) of use and are at the point where we will not be able to continue to update them. This is why we have announced an end-of-life plan for them, including End of Sale and End of Support dates.

In this particular case, we recognize that many SA3032, MF4100, and VR4100/VR4101 units are still in use and have opted to invest the development, testing, upgrade, support, and other logistical effort into offering an update. It is unlikely that we will be able to support those devices for other similar situations in the future.

For additional information and discussion around this topic, please see the webinar: Webinar Registration - Zoom.