CeRTNA is migrating APEX network endpoints to new hostnames under the certna.ca.gov domain.
Key dates:
By October 10, 2026 — add the new certna.ca.gov firewall rules below. Keep the existing certna.org rules in place; do not remove them yet.
October 31, 2026 — the legacy certna.org endpoints are fully decommissioned. Only on or after this date should the old rules be removed.
Full firewall documentation: Firewall & Network Settings (contact Greg Dapkus for SharePoint access).
What's Changing — Firewall Rules
New Whitelist Addresses:
All ERDS workstations should have these additional addresses allowed for outbound traffic. If your G2G workstation is also restricted, these should be applied to that workstation as well.
| Hostname |
IP Address:Port |
Description |
| apex-setup.certna.ca.gov |
104.42.220.68:443
20.59.104.73:443 |
APEX installation & updates |
| apex-erds.certna.ca.gov |
ERDS - APEX Service (ERDS only) |
| apex-reports.certna.ca.gov |
ERDS - APEX Reports (ERDS only) |
| apex-g2g.certna.ca.gov |
G2G - APEX Service (G2G only) |
| apex-g2g-reports.certna.ca.gov |
G2G - APEX Reports (G2G only) |
| apex-chk.certna.ca.gov |
APEX Internet Health Check |
| Hostname |
IP Address:Port |
Description |
| apex-setup.certna.ca.gov |
104.42.220.68:443 20.59.104.73:443 |
APEX installation & updates |
| apex-erds.certna.ca.gov |
104.42.220.68:443 20.59.104.73:443 |
ERDS - APEX Service (ERDS only) |
| apex-reports.certna.ca.gov |
104.42.220.68:443 20.59.104.73:443 |
ERDS - APEX Reports (ERDS only) |
| apex-g2g.certna.ca.gov |
104.42.220.68:443 20.59.104.73:443 |
ERDS - APEX Reports (ERDS only) |
| apex-g2g-reports.certna.ca.gov |
104.42.220.68:443 20.59.104.73:443 |
G2G - APEX Reports (G2G only) |
| apex-chk.certna.ca.gov |
104.42.220.68:443 20.59.104.73:443 |
APEX Internet Health Check |
What You Need To Do
-
By 10/10/2026: Add the new *.certna.ca.gov hostnames (or the broader wildcard *.certna.ca.gov) to your firewall/proxy allow list — ports 443 (HTTPS) and 80 (HTTP, for certificate revocation checks).
- Verify OCSP/CRL traffic to crl.sectigo.com and crl.usertrust.com over port 80 is permitted.
-
Keep the legacy *.certna.org rules active during this window — do not remove them yet, to avoid disrupting service.
-
Migrate your Client to the new .gov platform: A new APEX client will be released and should automatically update on September 13, 2026, adding new Platform login options ERDS.gov and G2G.gov for connecting to ERDS and G2G over the new certna.ca.gov endpoints. These new platform options will only work once the firewall rules above have been updated. After installing the new client, select ERDS.gov (or G2G.gov) from the Platform dropdown at login. The existing Production-ERDS / Production-G2G options will continue to work in the meantime.
-
On or after 10/31/2026: remove the retired *.certna.org rules. Another email will be sent with more details on what to remove and what your final firewall rules should look like in October.
- Continue enforcing the existing baseline: default-deny, sole-use restriction on APEX/ERDS workstations, and a local software firewall (e.g., Windows Defender Firewall) blocking unsolicited inbound traffic.
Also Note
· Wildcard domain rules (*.certna.ca.gov) are recommended over individual hostnames and static IPs for resilience against future infrastructure changes.
· Local proxy-based outbound blocking is no longer recommended or supported; use network/local firewall rules instead.
API Endpoint Update (Separate from Firewall Rules)
If your organization integrates directly with the APEX API (not required for standard client workstations), the service URL is changing:
· Current: https://apex-prd.certna.org/APEX/Service/APEXPublicServer.svc
· New: https://api-erds.certna.ca.gov/APEXPublicServer.svc
Both URLs will remain active during the transition. Update your integrating service(s) to the new URL by October 10, 2026; the old endpoint is retired on October 31, 2026. API documentation: DEV API Integrations.
Questions or Support
