Google Workspace
Google turns off legacy SCEP for ChromeOS
November 30, 2026 · In 45 days
Google · high confidence · Last verified October 15, 2026
What breaks
Legacy SCEP profiles stop issuing new client certificates to ChromeOS devices. Version pinning does not keep the mandatory server-side components running. Wi-Fi or other sign-in that needs a newly issued certificate fails for devices that have not moved to the Certificate Provisioning API.
Who is affected
- Google Workspace or Chrome Enterprise admins with legacy SCEP profiles for ChromeOS
- ChromeOS devices that enroll for a new client certificate through that legacy profile
- Networks that authenticate those devices with the certificate, including Wi-Fi
Source notes
Google’s help page says legacy Simple Certificate Enrollment Protocol profiles are scheduled for deprecation on November 30, 2026. Mandatory server-side components are turned off that day.
If you do not migrate, no new certificates are issued. The documented replacement is the Certificate Provisioning API, configured with a Google Cloud project, a SCEP configuration in the Admin console, and the Google Cloud Certificate Connector.
The page says the legacy profile can be deleted after devices authenticate with certificates issued through the new API.