Graph API v25.0 released, webhook mTLS certificates move to a Meta CA

What changed

Meta released Graph API and Marketing API v25.0 on February 18, 2026. The release notes say that from March 31, 2026 the Webhooks mTLS certificate is signed by a Meta-owned CA instead of DigiCert, while the common name stays client.webhooks.fbclientcerts.com. The node metadata parameter (metadata=1) was also deprecated, with removal on all versions on May 19, 2026.

What it means

Webhook receivers that verify Meta's client certificate must trust the new Meta-owned CA (meta-outbound-api-ca-2025-12.pem) or webhook delivery stops.