Hongkong Post e-Cert

Date: 15 January 2026

Adjust the Maximum Validity of e-Cert (Server) to Comply with Industry Standard

To comply with the updated Baseline Requirements for TLS Server Certificates issued by the CA/Browser Forum on 16 December 2025, Hongkong Post Certification Authority (HKPCA) will gradually reduce the maximum validity of all e-Cert (Server) certificate types, including:

e-Cert (Server)
e-Cert (Server) with "Wildcard" feature
e-Cert (Server) with "Multi-domain" feature
Extended Validation e-Cert (Server)
Extended Validation e-Cert (Server) with "Multi-domain" feature

Starting from 15 March 2026, the maximum validity period of all e-Cert (Server) certificates will be reduced in phases, depending on the issuance date:

Phase	Issuance Date	Maximum Validity Period
I	From 15 March 2026 To 14 March 2027, both dates inclusive	199 days
II	From 15 March 2027 To 14 March 2029, both dates inclusive	99 days
III	From 15 March 2029	46 days

Within the one‑year subscription period, e-Cert (Server) subscribers will be eligible to obtain an unlimited number of new certificates under the same application at no additional charge. The validity period of each new certificate will comply with the phased maximum validity period or reflect the remaining subscription period, whichever is shorter.

Example:

A subscriber has an one-year subscription valid from 15 March 2026 to 14 March 2027 during Phase I.

The following table illustrates the validity periods of all e-Cert (Server) certificates issued during this subscription period, depending on their exact issuance date:

Issuance Date	Certificate Validity	Expiration Date
From 15 March 2026 To 27 August 2026, both dates inclusive	199 days	199 days after issuance
From 28 August 2026 To 14 March 2027, both dates inclusive	Up to 199 days	14 March 2027

HKPCA will implement the following procedures and functions to streamline the issuance of new e-Cert (Server) certificates from Phase I. In view of the more frequent new certificate issuance requests in Phases II and III, HKPCA would continue to explore measures to further streamline and automate the issuance procedures. HKPCA would update subscribers in due course.

Procedures for Issuance of New e-Cert (Server) Certificate

HKPCA will notify subscribers to obtain their new e-Cert (Server) certificate before the certificate expires.

For each issuance of a new e-Cert (Server) certificate, the subscriber must:

generate a new Certificate Signing Request (CSR) from their server;
access the Submission of CSR webpage using the same PIN provided during the initial e-Cert (Server) application;
complete the Domain Control Validation (DCV) verification (for non-Government B/D subscribers only); and
submit the CSR and download the new e-Cert (Server) certificate.

New Functions for Domain Control Validation (DCV)

To streamline DCV during each issuance and renewal of the e-Cert (Server) certificate, the Submission of CSR webpage will be updated as below.

For non-Government B/D subscribers, the subscriber must select and complete one of the following DCV before submission of CSR :

BR 3.2.2.4.7 – “DNS Change”
BR 3.2.2.4.18 – “Agreed-Upon Change to Website v2” (for non-“Wildcard” subscribers only)
BR 3.2.2.4.4 – “Constructed Email to Domain Contact” (for non-“Multi-domain” subscribers only)

For Government B/D subscribers, there is no change to the existing workflow.

The DCV method BR 3.2.2.4.12 – “Validating Applicant as a Domain Contact” will be adopted by default. The step of selecting DCV is not required.

Notification Before Subscription Expiry

HKPCA will notify subscribers to renew their e-Cert (Server) subscription prior to the expiry of the subscription period. At the request of the subscriber, the subscription period will be renewed for one year.

Implementation Timeline

The new Submission of CSR webpage, featuring the online DCV verification function, will be implemented by 15 March 2026.

Applicable to new application or renewal application with certificate expiring on or before 3 April 2026

If you wish to apply for an e-Cert (Server) with a one-year validity period before the effective date, please:

submit your application by 6:00 pm on 3 March 2026; and
submit the CSR as soon as possible upon receipt of the “Submission of Certificate Signing Request (CSR)” notification email so that the issuance process is completed by 11:59 pm on 14 March 2026.

For further details, please refer to the e-Cert (Server) User Guide. For enquiries, please call HKPCA e-Cert Customer Service at 2921 6633 or email to enquiry@eCert.gov.hk.

| Back | Top |

| Certizen Limited | Hongkong Post |

End of Page