GlobalSign and AlphaSSL cross-sign on Windows Server

GlobalSign moved all customer and partner products on 27 July 2026 and the remaining accounts on 13 September 2026. Issuance from R3 with 200-day validity stopped by 27 August 2026. If your certificate was issued before your account moved, it still chains up to R3, R5 or R6, and there is nothing to do until the next renewal.

If the server sends the short chain to R46, these clients fail:

• iOS before 15 and macOS before 12. R46 entered the Apple list in September 2021.
• Android 13 and older. R46 reached AOSP with Android 14 in October 2023.
• Java installations that never received the July 2024 update (8u421, 11.0.24, 17.0.12, 21.0.4).
• Windows machines without outbound internet access, which cannot fetch new roots from Windows Update.
• Embedded equipment, payment terminals, printers and industrial devices with a fixed trust store.

On Linux you simply add the cross-signed certificate to the chain file after the intermediate and reload the web server. The rest of this guide is about Windows, where Schannel builds the chain itself.

1. Open the machine certificate store

Run certlm.msc from a command line started as administrator. Alternatively: Win+R, mmc, File → Add/Remove Snap-in, choose Certificates, Computer account, Local computer. The machine store is what matters. Certificates in the user store take no part in the chain the server sends.

2. Import the issuing intermediate

1. Expand Intermediate Certification Authorities and click the Certificates subfolder.
2. Right-click → All Tasks → Import.
3. Select the GCC intermediate file. Switch the file type to All Files (*.*) if it does not show.
4. Confirm the store is Intermediate Certification Authorities → Finish.

3. Import the cross-sign certificate

Repeat step 2 with r3r46cross2019.crt. The file belongs in Intermediate Certification Authorities, not in Trusted Root. It is technically an intermediate, because it was signed by someone else.

Then confirm that GlobalSign Root CA - R3 is present in Trusted Root Certification Authorities. Without the old root the server cannot build the long chain. The root ships with every maintained Windows version.

4. Quarantine GlobalSign Root R46

As long as GlobalSign Root R46 is active in Trusted Root, Schannel builds the short chain and sends it. The cross-sign certificate then sits unused in the Intermediate store.

5. Re-export the PFX with its chain and rebind

Some services hold on to the chain that was in the PFX the certificate was imported from. Export the certificate again with the full chain and bind it to the service anew.

$pw = Read-Host -AsSecureString "PFX password"
Export-PfxCertificate -Cert Cert:\LocalMachine\My\<THUMBPRINT> `
  -FilePath C:\temp\server-with-chain.pfx -Password $pw -ChainOption BuildChain

-ChainOption BuildChain builds the chain from the machine stores, that is, after the root has been quarantined. Import the PFX again and bind it to the service that uses the certificate.

6. Restart

Chain data is cached in the process that built the chain, and in lsass and HTTP.SYS. A full Windows restart is the only way to clear all of it. Restarting the individual role does not reach the Schannel chain cache, so the service can answer with the old chain afterwards and look as though the change did not work. Plan a restart window.

Chrome and Mozilla remove trust in GlobalSign Root CA - R3 on 15 April 2027, and in R5 on 15 April 2029. The cross-sign file itself is valid longer, but after the removal it adds nothing in an updated browser. It only helps the clients that receive no updates, and that is precisely why they still hold R3.

Treat the configuration as a transitional arrangement. Note which clients require it and plan their replacement. If you can confirm that none of your clients predate October 2023, you can lift the quarantine and let the chain stay short.