Important Information about Digicert Global Root G2 & G3 

Due to compliance with external PKI standards and policies as designed by the CABF and Mozilla Trust Program, Salesforce is announcing another update to its Public Root Certificates. As noted in previous posts in this community, we have had to migrate away from the Digicert G1 Root CA due to its depreciation and removal from the Mozilla Root Program. Removal from this program means it will no longer be trusted by common web browsers. 

We have heard feedback from customers with regards to this and we are making the decision to obtain TLS certificates that chain to the Digicert Global Root G2  instead of the Digicert G3 Root CA for an intermediary period. This aligns with our guidance around trusting the Mozilla Root Program as this CA is a member that set.Please note, there will always be risk to maintaining uptime if you do not follow our documentation for Certificates at Salesforce, we advise strongly against certificate pinning or only trusting a very small subset of CAs.

We will implement the change on Monday the 29th of September 5PM UTC and any certificates issued after this time will chain to the Digicert G2 Root CA for an intermediary period. The certificates in this chain will utilize the RSA algorithm and the SHA size will not be more than 256 bits. 

This decision will give customers who have legacy middleware or SAP integrations, which can not consume ECC keys or certificates signed using the SHA-384 hash the time needed to make the changes to their tech stacks. Legacy Java stacks can support these algorithms by applying the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files. If you need assistance with this, we advise you to speak with your Customer Success Manager who can put you in contact with Salesforce Professional Services to help you with this.

Thank you.

Andrew Kavanagh

Salesforce PKI Team