Eurex Clearing Readiness Newsflash | Transition from Broker Host Certificates to DigiCert CA Chain trust model for the FpML API, TEAPI, MC API and Eurex Clearing FIXML

With this Newsflash, Eurex Clearing informs its Clearing Members about the transition from individual host certificates to the DigiCert CA (Certificate Authority) chain trust model for the FpML API, Trade Entry API (TEAPI), Margin Calculator API (MC API), and the Eurex Clearing FIXML interface.

Beginning with the next server certificate rotation, Eurex Clearing will no longer publish individual host certificates in the Member Section. To support fully automated certificate rotations and reduce operational effort, Clearing Members are strongly encouraged to configure their systems to trust the DigiCert CA chain directly.

Since DigiCert Root and Intermediate CA certificates have significantly longer validity periods, systems configured to trust the DigiCert CA chain will automatically trust newly issued Eurex server certificates. This eliminates the need for manual certificate downloads and updates during future certificate rotations.

Please note that the validity of the certificates is specified by regulatory authorities, and it is consistent across all certification authorities.

The lifetimes of the certificates issued by external CA (DigiCert) will be reduced (see table below).

• For certificates issued by external CA (DigiCert), the current maximum lifetime of a TLS certificate is 398 days
• As of 15 March 2026, the maximum lifetime for a TLS certificate will be 200 days
• As of 15 March 2027, the maximum lifetime for a TLS certificate will be 100 days
• As of 15 March 2029, the maximum lifetime for a TLS certificate will be 47 days

Action required: Members must ensure that the required DigiCert certificates are installed prior to the activation in Simulation on 16 November 2026 and Production on 12 December 2026. 

Please note that Eurex Clearing will no longer provide newly issued broker host certificates for download via the Member Section or Website.

To facilitate this transition, the required DigiCert Root and Intermediate CA certificates can be obtained directly from the official DigiCert website:

• DigiCert Global Root G2: https://cacerts.digicert.com/DigiCertGlobalRootG2.crt
• DigiCert Global Root CA: https://cacerts.digicert.com/DigiCertGlobalRootCA.crt
• Detailed information on the CA chain and additional certificate formats are available on the DigiCert Trusted Root Authority page at DigiCert Trusted Root Authority Certificates

This transition applies to all FpML, TEAPI, MC API, and Eurex Clearing FIXML connections. As an exception, and only where technical constraints prevent timely migration to the DigiCert CA chain, the respective broker host certificate can be obtained through your Technical Key Account Manager (TKAM).

We kindly ask all Clearing Members to review their trust store configurations and ensure that their systems trust the DigiCert CA chain. No action is required for Clearing Members already using the DigiCert CA chain.

Should you have any questions or require assistance during this transition, please reach out to your Technical Key Account Manager (TKAM) or contact our technical support team via email at cts@deutsche-boerse.com.

Kind regards, 
Your Client Services Team 

Further information