Bright Data is replacing the SSL root certificate for brd.superproxy.io, and you must migrate to the new certificate on proxy port 44445 before the current certificates expire on September 25, 2026 at 00:00 UTC to avoid downtime.
The current certificates cannot be extended or renewed. After September 25, 2026 at 00:00 UTC, any traffic still relying on the old certificates on ports 22225 or 33335 will fail. Complete the migration before this date.
Who needs to migrate
You are affected if you use Bright Data proxies, SERP API or Web Unlocker API on port 22225 or 33335, and/or your code references a Bright Data .crt certificate file.
You are not affected if you connect through the Bright Data proxy API instead of native proxy mode, or if your account is verified through the KYC process and you do not load the certificate. See API vs. native access.
Migration timeline
Port 44445 and the new root certificate went live in July 2026. Both the old and new certificates are operational during the transition window, so you can migrate at your own pace before the deadline. On September 25, 2026 at 00:00 UTC the old certificates on ports 22225 and 33335 expire, and traffic that still relies on them fails.
What is changing
Prerequisites
- Access to the host that runs your scraping code or application, where the certificate is loaded or installed
- The new certificate file from Bright Data
- Ability to open outbound traffic to
brd.superproxy.io on port 44445 in your network or firewall
How to migrate to the new certificate
- Open port
44445 for outbound traffic to brd.superproxy.io. Ask your network or security administrator to allow this if outbound ports are restricted.
- Download the certificate bundle from brightdata.com/static/brightdata_proxy_ca.zip and save
brightdata_root_ca_44445.crt to the host that runs your code.
- Update your proxy port from your current port (
22225 or 33335) to 44445 in every place your code or tools connect to Bright Data. The new certificate must be used in conjunction with port 44445.
- Load or install the new certificate the same way you use the current one. For code that loads the certificate at runtime, point
--cacert (or your language’s equivalent) at the new file. For tools that require an installed certificate, follow the steps in SSL certificate installation.
- Test one request against
https://geo.brdtest.com/mygeo.json to confirm the migration was successful before switching all traffic.
The following cURL example shows a request using the new port and certificate:
How to verify the migration worked
- A request to
https://geo.brdtest.com/mygeo.json through port 44445 returns your geolocation JSON without an SSL error.
- Your existing scraping traffic continues to succeed after you switch the port and certificate.
If a request fails with an SSL error after migrating, confirm that the new certificate is the one loaded or installed on the host running the request, and that the request targets port 44445.
FAQ
What happens if I do not migrate by September 25, 2026?
Any traffic that still relies on the old certificates on ports 22225 or 33335 fails after September 25, 2026 at 00:00 UTC. The old certificates cannot be extended or renewed.
Can I use both certificates during the transition?
Yes. Both the old and new certificates are operational during the transition window, each on its own port, so you can migrate at your own pace before September 25, 2026. Use the certificate that matches the port you connect to.
Which products does this migration apply to?
Bright Data proxies, SERP API and Web Unlocker API connections that use a Bright Data SSL certificate in native proxy mode on port 22225 or 33335. 
