Overview
To strengthen security and update the infrastructure, we will sequentially update the certificate authority that issues Device Certificates to a new generation.
In the Target environments, the certificate authority will be switched to the new generation; however, except for some environments described below, no Configuration changes or procedures are required on the customer side.
Target customers are kindly requested to review the following changes and their impact on their own environment.
Change Date: Sequentially from Thursday, September 17, 2026
Change Details: Due to the certificate authority generation update, the issuer of the Device Certificates distributed to each Device will change as follows.
Current: Cybertrust DeviceiD Public CA G3h
New: Cybertrust DeviceiD Public CA G4h
Target
- Customers using Device Certificates in Access Control
- Customers whose License is 「HENNGE One」 and who have configured single sign-on on Chromebook
- Customers whose License is 「HENNGE One」 and who use Device Certificates for secondary purposes, such as VPN/Wi-Fi authentication
- Customers whose License is 「HENNGE One」 and who distribute Device Certificates via MDM
※Customers whose License is HENNGE One for Education are not affected by this change.
If you are unsure which contract plan applies to you, you can check this from Access Control Administration by following the Procedure below.
- From the Administration menu, select [Domain Settings] - [Others].
- Please check [License] in the 「Others」 section at the bottom of the screen.
・HENNGE One: Target
・HENNGE One for Education: Skipped Entries
Required Actions
If you use Device Certificates in the following environments, action may be required depending on how you use them.
- If you have configured single sign-on on Chromebook
- If you use Device Certificates for secondary purposes for VPN/Wi-Fi authentication
- If you distribute Device Certificates via MDM
The actions required for each of the above are as follows.
-
If you have configured single sign-on between Chromebook and Access Control
Configuration changes are required in the Google Workspace Admin console to support the new certificate authority (G4).
For item 3, 「Device Certificates for Single Sign-On」, under 「Device Settings」 in the following article, please update it to match the content described in the linked article.
[Access Control] Chromebook Single Sign-On (SSO) Connection Procedure -
If you use Device Certificates for secondary purposes for VPN/Wi-Fi authentication
If you use Device Certificates for secondary purposes, such as VPN/Wi-Fi authentication, to continue using Device Certificates issued by the new certificate authority in the same way, you may need to install the Root Certificate of the new certificate authority described later on the authentication server side.
Because the necessity and method of this Configuration depend on the specifications of the authentication server, please contact the service provider of your authentication server for details.
Cybertrust Device ID Repository -
If you distribute Device Certificates via MDM
If you distribute Device Certificates via MDM, you may need to install the Root Certificate of the new certificate authority on the MDM side.
Because the necessity and method of this Configuration depend on the specifications of the MDM, please check with your MDM service provider for details.
For more information on distributing Device Certificates via MDM, please also refer to the following article.
[Device Certificate] Distributing Device Certificates via MDM Service
Translation Disclaimer
This article has been automatically translated from the original Japanese version for your convenience.
While we strive to ensure accuracy, we cannot guarantee its reliability or completeness.
In the event of any discrepancies or questions regarding the content, the official Japanese version shall prevail.