FinlandTulli
Renew ICS2 message-declarant certificate by 26 October 2026
ICS2 message declarants must have the renewed certificate installed by 26 October 2026 after GlobalSign retired the old root; install the new Root CA and Intermediate CA.
By Taxxa AI OyPublished 26 October 2026
ICS2 message declarants (ICS2-sanomailmoittaja) must have renewed the Import Control System 2 (ICS2) digital certificate (certificate) by 26 October 2026. The notice announcing the renewal was published on 26 October 2026 as a Tiedote bulletin setting the same day, 26 October 2026, as the last date for updating the certificateTulli.
The renewal is driven by a change at the certificate supplier.Tulli GlobalSign has retired the R3 RootCA root certificate.
Tulli All new certificates are therefore signed with a new root certificate (Root CA)
Tulli and a new intermediate certificate (Intermediate CA)
Tulli, replacing the previous chain anchored at the retired root
Tulli.
For traffic arriving from the EU, declarants must install the new certificates into the certificate store (key store) used for customer authentication in the client role (Client Authentication).Tulli The two items to install are the root certificate (juurisertifikaatti, Root CA, crt file format)
Tulli and the intermediate certificate (alivarmenne, Intermediate CA, crt file format)
Tulli.
Tulli The practices for client authentication (Client Authentication) change as part of the same update.
The replacement customer-authentication certificates (Client Auth Certificates) carry new certificate particulars (Certificate subjects). The production certificate particulars are CN = DG TAXUD Customs PROD, OU = DG TAXUD, O = European Commission, L = Brussels, ST = Belgium and C = BE. The new subject particulars for the conformance (CONF) environment are CN = DG TAXUD Customs CONF, OU = DG TAXUD, O = European Commission, L = Brussels, ST = Belgium and C = BE.
The certificate swap concerns the addresses customs.ec.europa.eu and conformance.customs.ec.europa.eu.Tulli DG TAXUD is announcing the upcoming changes connected with replacing the certificates at those addresses, and the notice points declarants to those DG TAXUD announcements for the details of the swap.
The replacement files are provided as GlobalSign GCC R46 OV TLS CA 2025 in crt file format and GlobalSign Root R46 in crt file format, together with the TAXUD root-certificate (juurisertifikaatti) and intermediate-certificate (alivarmenne) files in crt file format. Further information is available from yritysneuvonta@tulli.fi, and related customer bulletins (asiakastiedotteet) are collected under the Tulliselvitys customs-clearance section.
Legal basis: EU Import Control System 2 (ICS2) client-authentication certificate requirements applied through the DG TAXUD certificate rotation of October 2026.
Install the new Root CA and Intermediate CA in the ICS2 key store immediately and verify client authentication before filing further declarations.