Bitbucket Pipelines compatibility with Salesforce SSL/TLS certificate change DigiCert Global Root G2

[Rohit Patwardhan]

Hi everyone,

We have an integration between Salesforce and Bitbucket Pipelines, and Salesforce has announced an upcoming SSL/TLS certificate change that may affect integrations.

Change details:
Effective February 5, 2026, Salesforce will rotate its certificate chain to use the DigiCert Global Root G2 root certificate.

What we’re trying to confirm:
We’d like to verify whether Bitbucket Pipelines and its underlying infrastructure already trust this root certificate, specifically:

• Whether DigiCert Global Root G2 is included in Bitbucket Pipelines’ trust store

• Whether there is any certificate pinning that could block the new chain

• Whether any configuration changes are required on our side to avoid connection failures

Context:
We are using Bitbucket Pipelines as part of our CI/CD and integration workflows.

If anyone from Atlassian or the community has already validated this change or has guidance on how Bitbucket handles trusted root certificates for outbound connections, we’d really appreciate your insight.

Thanks in advance for your help,
Rohit

[Syahrul · Accepted solution]

Hey @Rohit Patwardhan 

Welcome to the community.

As long as the base image you use in your pipeline trusts DigiCert Global Root G2, the change in Salesforce’s chain will not be blocked by Bitbucket-level pinning.

If your bitbucket-pipelines.yml uses typical public images (e.g. Atlassian-provided images, official Docker Hub images like node:XX, openjdk:XX, ubuntu:XX, alpine:XX, etc.):

• Those images use standard system CA bundles.
• DigiCert Global Root G2 is widely included in modern CA bundles (it’s the same root Atlassian itself is moving toward).
• You are unlikely to need any change in your Bitbucket Pipelines configuration just because Salesforce rotates to this root.

I hope this helps.

Regards,
Syahrul