A root certificate update is planned for parts of the Cloud Foundry environment on 23rd April 2026.
If your organization manages its own certificate trust stores, you may need to update them to avoid connection issues after the change.
What is changing?
The environment is moving to newer root certificate authorities with a higher security level.
As part of this update, the following new root certificates need to be trusted:
DigiCert TLS RSA4096 Root G5
DigiCert Global Root G3
If your systems currently trust DigiCert Global Root G2 for relevant Cloud Foundry connections, you should add the new certificates as part of the transition.
Why is this happening?
This change is being introduced to align with updated security recommendations and stronger certificate key-length standards.
Who needs to take action?
You may need to take action if your organization:
uses a custom trust store
manually manages trusted certificates in client systems
uses certificate pinning or restricted trust settings
connects to relevant Cloud Foundry platform domains through systems that do not rely on regularly updated default trust stores
What do you need to do?
Please check whether your systems contain the certificate:
DigiCert Global Root G2
If yes, and it is used for relevant Cloud Foundry connections, add these certificates to the trust store as well:
DigiCert TLS RSA4096 Root G5
DigiCert Global Root G3
Important:
keep DigiCert Global Root G2 in place during the transition period
do not remove it yet
trust both the old and new certificates during the migration period
What happens if no action is taken?
If your trust store only contains the older certificate and does not trust the new certificate chain, affected integrations may fail after the update.
This may result in:
SSL or TLS handshake errors
failed connections to affected services
disruption to integrations using those endpoints
Need help?
If you are unsure whether your setup is affected, please contact [email protected].