Eurex Clearing has told members to update how their systems trust the servers behind four critical clearing interfaces. Its 26 October readiness notice replaces the practice of downloading individual broker host certificates with a DigiCert certificate-authority chain model. The stated simulation activation is 16 November and production activation 12 December 2026, giving members two separate deadlines for checking configuration.[1]
The affected interfaces are the Financial products Markup Language API, Trade Entry API, Margin Calculator API and Eurex Clearing FIXML connection. These serve processes that can include trade submission, lifecycle handling, risk calculations and reporting. An authentication problem after a certificate rotation can interrupt a participant's ability to communicate with those systems even if the underlying trading venue itself is otherwise available.[1]
Under the older workflow, a member might manually download and trust a newly issued Eurex host certificate whenever the server certificate changed. The revised approach is to establish trust in the relevant DigiCert root and intermediate authorities. Newly rotated certificates chaining correctly to those trusted authorities should then be accepted without loading each individual leaf certificate. This is a public-key infrastructure configuration change, not a change to clients' login passwords or clearing membership status.[1]
Two environments, one certificate-trust change
Eurex says it will no longer distribute newly issued individual broker host certificates through the Member Section or website following the transition. Firms that already use the approved DigiCert chain do not need to change their trust-store setup. Where a technical constraint genuinely prevents chain migration on time, the notice allows members to contact their Technical Key Account Manager to obtain the host certificate as an exception.[1]
The notice also discusses shorter maximum validity periods for publicly issued TLS certificates over the coming years. The operational consequence is a stronger case for automated certificate handling, not evidence that DigiCert certificates all expire on the Eurex production date. Chain trust simplifies future rotations only if validation rules and trust stores are themselves maintained correctly.[1]
Published Eurex DigiCert transition milestones
| Item | Date or requirement | Practical scope |
|---|---|---|
| Simulation trust-chain activation | 16 November 2026 | Test members and service providers |
| Production trust-chain activation | 12 December 2026 | Live clearing interfaces |
| Covered interfaces | FpML, TEAPI, MC API and FIXML | Not all web or exchange services |
| Member already trusting chain | No trust-store change needed | Still confirm connectivity |
The distinct November and December dates matter for vendor testing: simulation readiness can be checked before production certificate cutover. Brokers and clearing-service firms can verify trust anchors, certificate-chain validation and connection monitoring for each affected API. Eurex's release does not say that the cryptographic change alters margin models, settlement rules or trading permissions; it is an infrastructure continuity notice for existing clearing connections.[1]
Sources & further reading
- Readiness Newsflash: transition to DigiCert CA chain trust model Eurex Clearing · 26 Oct 2026 · Accessed 31 Oct 2026