Hongkong Post e-Cert

Date: 1 April 2025

Updating e-Cert (Server) to comply with Chrome Root Program Policy

Following Google’s recent update to the Chrome Root Program Policy on 15 February 2025, which promotes the use of dedicated TLS server authentication PKI hierarchies, Hongkong Post Certification Authority (HKPCA) will implement the following changes to e-Cert (Server) certificates and their respective Sub CA certificates.

The “Client Authentication” attribute in the “Extended Key Usage” (EKU) field of e-Cert (Server) will be removed.
The Sub CA certificates “Hongkong Post e-Cert EV SSL CA 3 – 17” and “Hongkong Post e-Cert SSL CA 3 – 17” will be reissued with the EKU fields included to only assert “Server Authentication”.

The transition plan is arranged as follows:

Date	Event
With immediate effect	Trial e-Cert (Server) and new Trial Sub CA certificates are available for testing upon request.
Starting from 1 May 2025	e-Cert (Server) will be issued by New Sub CA certificates. Only e-Cert (Server) with the “Server Authentication” attribute in the EKU field will be issued. e-Cert (Server) with the “Client Authentication” attribute in the EKU field will CEASE to be issued.
Before 15 June 2026	Old Sub CA certificates without EKU fields will be revoked.

Please note that e-Cert (Server) issued before 1 May 2025 will not be affected.

Actions to be taken by e-Cert (Server) Subscribers

Subscribers are advised to download and install the new Sub CA certificates at the same time when installing their e-Cert (Server) which are issued on or after 1 May 2025. The following deliverables are available for download from the HKPCA website:

Subscribers and relying parties should review their current use of the “Client Authentication” attribute in the EKU field in their systems and applications. They should ensure that their systems and applications can operate with e-Cert (Server) certificates that do not include this attribute.

Support Arrangement

Trial e-Cert (Server) and their respective Trial Sub CA certificates are available for testing upon request. To request trial certificates for testing or enquire about this update, please call Hongkong Post Certification Authority e-Cert Customer Service at 2921 6633 or email to enquiry@eCert.gov.hk.

| Back | Top |

| Certizen Limited | Hongkong Post |

End of Page