Summary
Planned Maintenance
- TLS certificate chain update (SSL.com root migration).Planned start
- 08:00 UTC, 11 November 2026- We are updating the main certificate for neo4j.io.
- No action is required if you connect to Aura using standard, up-to-date TLS clients (supported Neo4j drivers with default trust, current browsers).
- You could be impacted by this change if you hardcode or pin SSL.com intermediate or root certificates when connecting to Aura endpoints on neo4j.io.
What is changing
- The public certificate chain presented on affected neo4j.io endpoints, including database connectivity.
- The trust path your clients use when validating those endpoints.
You may need to update your environment only if you:
- Pin SSL.com intermediate or root certificates, or a fixed leaf public key, when connecting to *.neo4j.io Aura endpoints (including database URLs)
- Use a custom trust store that does not include SSL.com TLS RSA Root CA 2022 or that only trusts the legacy SSL.com / cross-sign chain.
CAUTION: Neo4j discourage pinning intermediate Certificate Authorities for Aura. Use default system trust and keep Neo4j drivers and browsers up to date.
Further information
SSL.com is migrating public TLS issuance from legacy 2016 trust hierarchies to newer 2022 roots. We will deploy an updated leaf certificate and chain that validates through SSL.com TLS Issuing RSA CA R1 to SSL.com TLS RSA Root CA 2022, replacing the previous chain (legacy SSL.com RSA subCA, 2016-era root, and cross-signed intermediates).
These PKI changes originate with SSL.com (our public CA), not with a separate Neo4j-operated CA for Aura. We are updating the deployed material so TLS remains trusted on current operating systems and browsers and aligns with modern root-program requirements.