Skip to main content
GroupsCertificate ChangesAndrew Kavanagh's Post
Andrew Kavanagh (Salesforce) posted in Certificate Changes
Jan 22, 3:14 PM

Salesforce Root Certificate Update to Digicert Global G2 

 

This is a follow up to the emails sent to Salesforce Admins. 

 

Salesforce will begin issuing certificates from the 

DigiCert G2 Global Root CA on February 5th at 5:00 PM UTC. To prevent connection failures, your systems must trust this new root. This related to systems that make One-Way Inbound TLS connections to Salesforce (for example your browser or API connecting to login.salesforce.com). 

 

Check your environment’s trust store to ensure the DigiCert Global Root G2 is present. While most modern, patched browsers and OSs include it by default, you must manually verify your specific setups to verify this.

  • API & Integration Users: Check the trust stores for your specific runtimes (JVM, Python, Node.js, etc.).
  • Best Practice: Salesforce documentation states trusting the Mozilla Root Pinset to ensure high availability and security during future CA rotations. Salesforce may at any time change our Root CA to respond to engineering, security, high availability or disaster recovery incidents. 

What is NOT in scope 

  • Customer Self-Signed Certificates that are uploaded in the Salesforce application
  • Customer-managed CA Signed Certificates that are uploaded in the Salesforce Application

Key Details to Remember

  • No "Big Bang" Renewal: Existing certificates won't all change at once. They will rotate organically based on their individual expiration dates using the new DigiCert G2 chain.
  • Stay Informed: Review the official documentation to ensure uninterrupted access, especially for Hyperforce users.

Resources

Questions? Please log a case

8 comments
  1. Pankaj Paryani (Kliqxe Technology)
    Feb 6, 8:28 AM

    Thanks @Yuri Garcia Caetano

    for the input, I have the same question in hand. 

    One of my client has an integration where there is dependency on Salesforce certificate. Any change on Salesforce certificate needs to be reflected in other system. 

    And we have seen evidently that Salesforce certificate change breaks that integration. 

     

    I need to ensure when this G2 root certificate change is going to be applied on their instances so that we can have the maintenance window there. 

     

    @Andrew Kavanagh

    is there any idea on the approach for this G2 Root certificate change rollout, Atleast type of instances like Sandbox or Production. 

    Or simply should we wait for it to happen.

Write a comment...
0/9000