Public TLS trust · Confirmed removals; rollout dates announced
Check affected TLS chains before October 27–28 trust changes
Announced October 20, 2026. Sources checked October 26, 2026.
Google expects removal of emSign ECC Root CA - G3 from the Chrome Root Store on October 27, morning PDT. Its October 20 notice tells affected website operators to install a certificate from another trusted hierarchy. AWS's October 24 bulletin separately sets October 28 for replacing affected identity-provider certificates used by Application Load Balancer OIDC or JWT authentication.
Who it affects. Check the actual chain: Chrome's notice names emSign ECC Root CA - G3. AWS lists AAA Certificate Services, emSign Root TLS CA – G3, and emSign ECC Root CA – G3. AWS also targets October 28 for CloudFront origin trust-bundle removal. These are public-TLS trust changes, not new private-PKI rules or shortened certificate validity periods.
What remains uncertain. The notices do not establish your endpoint's chain or a completed rollout everywhere. Chrome's intermediate-key block and its root removal are separate measures; AWS service schedules also differ. An unexpired certificate can still lose client trust.
One next step. Have the certificate owner check affected website, origin and identity-provider chains with the service owner, arrange any required replacement before the applicable date, and verify the deployed chain and authentication flow. Use the relevant vendor notice for scope.
Token refresh · Public preview; opt-in
Check token consumers before opting into GitHub CLI expiration
Announced October 21, 2026. Sources checked October 26, 2026.
The CLI can store a short-lived access token with a rotating refresh token and refresh access when needed. The opt-in login flag is --expiring. Existing sign-ins and manually supplied tokens keep their current behavior.
Who it affects. GitHub CLI users on github.com and ghe.com; GitHub identifies GHES 3.23 for server support. Unsupported servers fall back to non-expiring credentials. This concerns CLI OAuth sign-in, separate from GitHub App user-token and installation-token changes.
What remains uncertain. Scripts or extensions that copy a token once may later use an expired value. GitHub recommends its CLI credential helper for Git over HTTPS and Git 2.46 or newer. A future default is planned without a release date; this is not a forced migration.
One next step. Ask the developer-tooling owner to trace one workflow's token consumers before a pilot. Test refresh through the CLI or credential helper; defer opt-in for consumers that still require a cached, long-lived token.
Workflow access · Revised enforcement date
Move the affected Actions policy deadline to December 2
Announced October 21, 2026. Sources checked October 26, 2026.
An editor's note on GitHub's September 17 announcement changes the enforcement date to December 2, 2026. GitHub's workflow-security documentation confirms that date. We have also corrected our September 21 edition with a dated note.
Who it affects. Affected public repositories that used the default pull_request_target policy before general availability. The default does not apply to private or internal repositories or replace an applicable event policy already configured.
What remains uncertain. The revised date does not establish a repository's effective policy or make a privileged workflow safe. This trigger can expose base-repository secrets if the workflow executes untrusted fork code.
One next step. Have the workflow owner update the recorded deadline and review policy insights before December 2. Decide whether each affected workflow needs the trigger and review its code before allowing an exception.
Related
Where to go next
Token handling: GitHub Apps, Dependabot, and SageMaker