You likely recently received an email from Salesforce regarding changes to their security certificates that warned that action is required to avoid service interruptions. The guidance in the email, however, has raised many questions from clients.

The headline: this is a change that is potentially high-impact but unlikely to cause issues unless you have inbound integrations to Salesforce where you have failed to update software on the servers, or if you have used pinned TLS certificates to secure your integration. For most Salesforce orgs, there will be zero impact to these changes.

What's changing

As part of an industry-wide shift, Salesforce will upgrade the root certificate it uses to sign its security certificates. Browser makers, including Mozilla and Google Chrome, have announced plans to remove support for the DigiCert Global Root G1 certificate that Salesforce has previously used. Eventually, that would cause new versions of Chrome and Firefox to stop treating connections to Salesforce as secure. To get ahead of that, Salesforce is moving to use the newer G2 root certificate.

When you connect to a secure website the browser ensures that the connection is secure by obtaining a certificate from the server and verifying that it is valid. That verification traces the certificate through a number of intermediate certificates and back to the root certificate used to create it. This ensures that the certificate is valid, was issued by a trusted authority, and hasn't been revoked.

While this check could be performed by contacting the server of the issuing Certificate Authority (CA), devices often rely on a locally installed version of the root certificate as a means of speeding the process. As you might imagine, if the root certificate changes, verifications can fail if your devices aren't up-to-date–they could be missing the new certificate if they're not.

You're probably unaffected

The good news is that the "new" G2 certificate has been widely trusted for many years, and should be installed on any devices from the last decade or so. Cloud-based services and products that integrate with Salesforce should also have long ago prepared for this change–it's been a long time coming.

But...

This change might impact you if one of the following is true:

1. You maintain an external application that connects to Salesforce (especially for on-premises servers) and you maintain your own certificate trust store, instead of relying on the underlying operating system (for example, a Java key store). If you've neglected to update your servers, it's possible you've missed installing the new certificate.
2. You use certificates that use Certificate Pinning, a method of storing a certificate that can in theory increase security but often causes issues. We mentioned that devices verify certificates are valid–this happens by checking a public key that is published by the CA. But if you use pinned certificates, your application has been set to trust only specifically enumerated lists of public keys. When DigiCert shifts to the new root certificate and changes the public key that secures it, your application will no longer treat the certificate as trusted unless you update your pinned settings.

For most clients, this will not be an issue. But if you are affected, Salesforce recommends doing the following:

1. Ensuring the new root certificate is installed to your devices. Instead of installing the individual DigiCert Global Root G2 Certificate, you can trust the Mozilla Root Program, which is a vetted group of globally-trusted root certificates. Doing that will ensure you're compliant with the next shift.
2. Ensuring any pinned certificates are replaced with standard certificates that simply rely on the ones stored in your trust store (e.g. the local OS). For what it's worth, replacing pinned certificates has been DigiCert's recommendation for at least five years.

Perform these actions before February 5th, at which point Salesforce will transition to the new certificates. You should also monitor integrations after this date to ensure none were missed.

Have questions? You can join us for an upcoming Office Hours session, or submit a request–we're happy to help!