Assessing impact on Salesforce integration with upcoming root certificate changes effective February 5

Proposal

A GitLab Dedicated customer reached out asking for impact assessment on Salesforce integration for upcoming changes to Salesforce due to the Root Certificate Changes.

Salesforce Advisory:

What is changing?

As part of our commitment to platform security and engineering standards, Salesforce is updating its digital certificate infrastructure. Starting February 5, 2026, Salesforce certificates will begin to be chained from the Digicert Global Root G2 (Digicert G2 Root).

While Salesforce may change Root Certificate Authorities at any time to respond to security or industry events, this specific transition requires customer preparation to ensure continued connectivity.

What is the impact?

If your trust stores do not include the Digicert G2 Root certificate by the enforcement date, your systems will be unable to establish a secure connection to Salesforce. This impact applies to:

API Connections:

• Critical integrations may fail to authenticate.

Browser Access:

• Users may encounter security warnings or experience issues accessing Salesforce via web browsers.

Availability:

• Failure to take action will result in a loss of service uptime and availability.

What actions do I need to take?

You must ensure that the Digicert Global Root G2 (Digicert G2 Root) is present in your environment's trust stores before February 5, 2026.

Salesforce strongly advises customers to trust the Mozilla Certificate Rootset as per our official documentation. This is a comprehensive collection of multiple Root Certificate Authorities trusted by Mozilla, which includes the necessary Digicert G2 Root and provides a proactive defense against future root rotations.

Where can I get additional information?

For detailed technical guidance on managing certificate rotations, please review the Certificates in Salesforce Help article. Digicert Root CAs can be found here.