TLS certificate chain update (SSL.com root migration)
Scheduled for Nov 10, 08:00 - 20:00 UTC
Subscribe to Updates
Scheduled
Planned start - 08:00 UTC, 11 November 2026
We are updating the main certificate for neo4j.io.
No action is required if you connect to Aura using standard, up-to-date TLS clients (supported Neo4j drivers with default trust, current browsers).
You could be impacted by this change if you hardcode or pin SSL.com intermediate or root certificates when connecting to Aura endpoints on neo4j.io.
What is changing:
- The public certificate chain presented on affected neo4j.io endpoints, including database connectivity.
- The trust path your clients use when validating those endpoints.
You may need to update your environment only if you:
- Pin SSL.com intermediate or root certificates, or a fixed leaf public key, when connecting to *.neo4j.io Aura endpoints (including database URLs)
- Use a custom trust store that does not include SSL.com TLS RSA Root CA 2022 or that only trusts the legacy SSL.com / cross-sign chain.
CAUTION: Neo4j discourage pinning intermediate CAs for Aura. Use default system trust and keep Neo4j drivers and browsers up to date.
Further information
SSL.com is migrating public TLS issuance from legacy 2016 trust hierarchies to newer 2022 roots. We will deploy an updated leaf certificate and chain that validates through SSL.com TLS Issuing RSA CA R1 to SSL.com TLS RSA Root CA 2022, replacing the previous chain (legacy SSL.com RSA subCA, 2016-era root, and cross-signed intermediates).
These PKI changes originate with SSL.com (our public CA), not with a separate Neo4j-operated CA for Aura. We are updating the deployed material so TLS remains trusted on current operating systems and browsers and aligns with modern root-program requirements.
We are updating the main certificate for neo4j.io.
No action is required if you connect to Aura using standard, up-to-date TLS clients (supported Neo4j drivers with default trust, current browsers).
You could be impacted by this change if you hardcode or pin SSL.com intermediate or root certificates when connecting to Aura endpoints on neo4j.io.
What is changing:
- The public certificate chain presented on affected neo4j.io endpoints, including database connectivity.
- The trust path your clients use when validating those endpoints.
You may need to update your environment only if you:
- Pin SSL.com intermediate or root certificates, or a fixed leaf public key, when connecting to *.neo4j.io Aura endpoints (including database URLs)
- Use a custom trust store that does not include SSL.com TLS RSA Root CA 2022 or that only trusts the legacy SSL.com / cross-sign chain.
CAUTION: Neo4j discourage pinning intermediate CAs for Aura. Use default system trust and keep Neo4j drivers and browsers up to date.
Further information
SSL.com is migrating public TLS issuance from legacy 2016 trust hierarchies to newer 2022 roots. We will deploy an updated leaf certificate and chain that validates through SSL.com TLS Issuing RSA CA R1 to SSL.com TLS RSA Root CA 2022, replacing the previous chain (legacy SSL.com RSA subCA, 2016-era root, and cross-signed intermediates).
These PKI changes originate with SSL.com (our public CA), not with a separate Neo4j-operated CA for Aura. We are updating the deployed material so TLS remains trusted on current operating systems and browsers and aligns with modern root-program requirements.
This scheduled maintenance affects: Aura Console (console.neo4j.io), Aura API (api.neo4j.io), Aura Agent, Aura MCP Service, AuraDB Free (*.databases.neo4j.io), AuraDB Virtual Dedicated Cloud (*.databases.neo4j.io) (AuraDB Virtual Dedicated Cloud on AWS (*.databases.neo4j.io), AuraDB Virtual Dedicated Cloud on Azure (*.databases.neo4j.io), AuraDB Virtual Dedicated Cloud on GCP (*.databases.neo4j.io)), AuraDB Professional (*.databases.neo4j.io) (AuraDB Professional on AWS (*.databases.neo4j.io), AuraDB Professional on Azure (*.databases.neo4j.io), AuraDB Professional on GCP (*.databases.neo4j.io)), Neo4j User Tools (Bloom (bloom.neo4j.io), Browser (browser.neo4j.io), Data Importer (data-importer.neo4j.io), Aura Customer Metrics (customer-metrics-api.neo4j.io)), AuraDS (*.databases.neo4j.io) (AuraDS on AWS (*.databases.neo4j.io), AuraDS on Azure (*.databases.neo4j.io), AuraDS on GCP (*.databases.neo4j.io)), AuraDS Enterprise (*.databases.neo4j.io) (AuraDS Enterprise on AWS (*.databases.neo4j.io), AuraDS Enterprise on Azure (*.databases.neo4j.io), AuraDS Enterprise on GCP (*.databases.neo4j.io)), AuraDB Business Critical (*.databases.neo4j.io) (AuraDB Business Critical (*.databases.neo4j.io) on AWS, AuraDB Business Critical (*.databases.neo4j.io) on Azure, AuraDB Business Critical (*.databases.neo4j.io) on GCP), and Aura Graph Analytics (Aura Graph Analytics on AWS, Aura Graph Analytics on Azure, Aura Graph Analytics on GCP).