# Sentry’s February 2027 TLS issuer switch will break pinned and some legacy clients Sentry will move its ingestion and web TLS certificates from DigiCert to Google Trust Services and Let’s Encrypt in February 2027. Most SDKs need no change, but certificate-pinned integrations and older runtimes that do not trust ISRG Root X1 can stop connecting after the cutover. The endpoint names are staying the same, but the trust chain is not. Teams that pin Sentry certificates or still ship very old Android/Java runtimes need to remove or update those assumptions before Sentry publishes its exact February cutover date. - Status: Active - Published: 2026-08-28T22:08:45+12:00 - Updated: 2026-08-28T22:08:45+12:00 - Categories: Web Development, Cloud & Infrastructure, Developer Tools, Observability - Tags: certificate authorities, legacy clients, Sentry, TLS - Canonical HTML: https://beyondthe.news/dossiers/sentry-tls-certificate-authority-google-trust-lets-encrypt-february-2027 ## What changed Sentry announced on August 26, 2026 that its ingestion and web endpoints will change TLS certificate authorities in February 2027. Today those certificates are issued by DigiCert; after the cutover Sentry will use Google Trust Services and Let’s Encrypt. Sentry says domains and ordinary SDK connection behavior remain unchanged for almost all customers. The exceptions are integrations that pin Sentry’s certificate or issuing CA and older platforms that do not trust the Let’s Encrypt ISRG Root X1 certificate. Sentry will publish the exact cutover date later. ## Why it matters Observability is often most valuable during failures, so a telemetry client that silently loses TLS trust can turn an application incident into an observability blind spot. The change is routine PKI maintenance for modern systems but a hard compatibility boundary for pinned clients and legacy trust stores. Teams that ship embedded software, older mobile apps, long-lived Java services, restricted enterprise environments or custom proxies should test the trust path now rather than discovering the break after the certificate chain changes. ## The hostnames stay stable while the trust anchors change Sentry says customers will continue sending events to the same ingestion and web domains. The material change sits below the application protocol: DigiCert-issued certificates will be replaced by certificates from Google Trust Services and Let’s Encrypt. Standard operating systems and modern runtimes already trust those authorities, so most SDKs should reconnect normally when certificates rotate. ## Certificate pinning becomes a guaranteed failure unless updated Sentry explicitly says connections will fail after cutover if an integration pins the current Sentry certificate chain. Its recommended path is to remove pinning for Sentry domains; teams that must pin certificate authorities instead need to add the new GTS and Let’s Encrypt authorities before the transition. Hard-coding an individual leaf certificate would remain fragile after future rotations as well. ## Old trust stores can also lose telemetry Sentry calls out clients that do not trust Let’s Encrypt’s ISRG Root X1. Examples include Android versions before 7.1.1 and Java runtimes before JRE 8u141 or 7u151. Those are old platforms, but long-lived enterprise, appliance and embedded deployments can outlast ordinary application-upgrade cycles. ## A successful app request does not prove Sentry telemetry works Because the change affects the Sentry connection rather than the application’s own backend, production services can continue operating while errors, traces or other telemetry fail to upload. Teams with legacy clients should verify Sentry transport independently and alert on sustained ingestion drops rather than assuming the application’s primary connectivity covers the observability path. ## The exact cutover day is still pending Sentry has committed to February 2027 and says it will publish the precise date in another changelog entry and on its status page. Operators should complete trust-store and pinning work before February rather than wait for the final date, especially where client releases or appliance upgrades have long lead times. ## Key details - Sentry announced the TLS certificate-authority change on August 26, 2026. - The cutover is planned for February 2027; an exact date has not yet been published. - Sentry currently uses DigiCert-issued certificates for ingestion and web endpoints. - The new issuers will be Google Trust Services and Let’s Encrypt. - Sentry domains are not changing. - Certificate-pinned Sentry connections can fail after the cutover unless pinning is removed or updated. - Sentry specifically warns about old clients that do not trust Let’s Encrypt ISRG Root X1. - Examples include Android before 7.1.1 and Java JRE before 8u141 / 7u151. - Sentry recommends removing certificate pinning for its domains where possible. ## Builder takeaways - Search mobile, desktop, server, proxy and appliance code for Sentry certificate or CA pinning now; do not assume only the official SDK can control TLS behavior. - If pinning is mandatory in your environment, update the trusted CA set to include the issuers Sentry documents and test against representative certificate chains before February. - Inventory old Android and Java versions that still send telemetry and upgrade or replace their trust stores before the cutover. - Monitor Sentry ingestion volume and transport errors separately from application health so a trust-chain failure does not go unnoticed. - Avoid waiting for Sentry’s exact February date if releasing client fixes is slow; the compatibility requirement is already known. - Treat this as a useful reminder that third-party telemetry endpoints are production dependencies whose DNS, TLS and trust-chain assumptions belong in dependency inventories. ## What to watch - Sentry’s exact February 2027 cutover date. - The final certificate chains and roots documented immediately before migration. - Whether Sentry offers a pre-production endpoint or test path for validating new trust stores. - Reports of enterprise proxies, embedded clients or older SDK environments encountering unexpected trust issues. - Whether any Sentry SDKs add explicit diagnostics for TLS trust failures around the migration window. ## Uncertainties - Sentry has not yet published the exact February cutover day. - The overwhelming majority of modern clients should be unaffected, so the practical population at risk depends on each customer’s pinning and legacy-runtime footprint. - Enterprise TLS interception or custom trust stores can create additional compatibility behavior that Sentry cannot fully predict from public platform versions alone. ## Sources - [We're Changing Our TLS Certificate Authority in February 2027](https://sentry.io/changelog/were-changing-our-tls-certificate-authority-in-february-2027/) — Sentry · primary/vendor · 2026-08-26T00:00:00+12:00. Primary announcement for the DigiCert-to-GTS/Let’s Encrypt transition, pinning impact, legacy trust-store examples and future exact cutover notice. - [Sentry Changelog](https://sentry.io/changelog/) — Sentry · primary/vendor · 2026-08-26T00:00:00+12:00. Current product changelog confirming the February 2027 TLS certificate-authority change.