Client Authentication Certificate Changes: What to know

Update: Client authentication certificate changes and what they mean for you

September 2026 update: J.P. Morgan’s Private CA capability for eligible API connections is now targeted for Q4 2026. Existing valid certificates remain supported until expiration and no immediate action is required solely because of this revised timeline.

If you use mutual TLS (mTLS) certificates to connect with our J.P. Morgan Application Programming Interface (API) services, there are upcoming industry changes to how client authentication certificates are issued.

We’re taking action to help support you successfully navigate these changes. Provided below is an overview of what’s changing, what stays the same and how to stay connected without disruption.

What’s changing

Recent changes to public trust store and root program policies mean some public Certificate Authorities (CAs) may no longer issue publicly trusted certificates that include the Client Authentication Extended Key Usage (EKU).

This change reduces risk of misuse or unauthorized access by separating certificates used for server authentication from certificates used for client authentication.

Several public CAs have already begun to implement this change. Some trust stores are set to reject such certificates starting March 15, 2027.

Even for non-browser, server-to-server mTLS, these ecosystem changes can affect certificate issuance and ongoing support.

Who’s affected

You’re affected if you need to obtain an mTLS certificate that includes the Client Authentication EKU, such as for a renewal, rotation, compromise response, or new eligible API connection.

What J.P. Morgan is doing

In response to this change and to help ensure continuity, J.P. Morgan’s Private CA will issue and support mTLS certificates for eligible API connections.

We will enable eligible clients to submit a Certificate Signing Request (CSR) through the Payments Developer Portal (PDP), integrating with our Private CA to provide a valid certificate for their mTLS connection.

Our Private CA will provide supported client authentication certificates so you can maintain secure, uninterrupted connectivity. We’re targeting a Q4 2026 release date for this functionality and will provide more information as the capability approaches release.

What stays the same

We will continue to support existing valid certificates until their expiration date. No endpoint changes are required for this transition.

Timeline at a glance

• Public CAs: Many may no longer issue certificates with the Client Authentication EKU going forward.
• Public trust store / CA program policy: Some trust stores will reject these certificates starting March 15, 2027.
• J.P. Morgan support: Our Private CA is targeted for Q4 2026 for eligible API connections and will provide supported client authentication certificates so you can maintain secure, uninterrupted connectivity.

What you need to do now

No immediate action is required while your current certificates are still valid.

As your existing mTLS certificates near expiration, review the acceptable Certificate Authorities (CAs) listed in our authentication guidance. Check with these CAs directly to determine whether they still provide certificates that include the Client Authentication EKU.

If you need a new certificate before J.P. Morgan’s Private CA capability becomes available, use an approved CA if available and begin the renewal process early enough to avoid disruption. Do not allow an existing certificate to expire while waiting for the new capability.

Recommended preparation

• Inventory your mTLS certificates and note expiration dates.
• Confirm your process for generating CSRs aligns with your organization’s security policies.
• Ensure your technical and operational contacts are current so we can reach the right teams.

What’s coming next

We’re establishing a streamlined and automated process for eligible clients to request and obtain certificates from our Private CA through the Payments Developer Portal. We’ll share confirmed timing and detailed instructions ahead of any required action on your side.

Quick FAQ

• Will my current connections stop working right away?
  • No. Existing client authentication certificates remain valid until they expire. There’s no immediate change to your current connectivity.
• Do I need to switch CAs today?
  • You may switch at your convenience, but there is no requirement to renew early. Reference approved CAs and check with them directly to determine if they still provide certificates that include the Client Authentication EKU.
• How will I request a new certificate from J.P. Morgan?
  • Eligible clients will submit a CSR through the Payments Developer Portal. We’ll provide step‑by‑step guidance as the process becomes available.
• When will I be able to request a certificate using J.P. Morgan’s Private CA?
  • We’re targeting a Q4 2026 release date. We will update communications once the delivery date has been confirmed.
• Should I wait for the J.P. Morgan Private CA capability before renewing?
  • Do not allow an existing certificate to expire while waiting for the new capability. If renewal is required sooner, follow the current guidance for obtaining a certificate from an approved CA.

Questions?

We’re here to help ensure your connections remain secure and uninterrupted:

• Phone: 978-805-1200, Option 1
• Email: Payments Connectivity - Client AUTH EKU Deprecation