announce root change (#14048)

## DESCRIBE YOUR PR
We plan to change the issuer of our certificates from DigiCert to Let's
Encrypt. We want to announce this change broadly so nobody is too
surprised.

## IS YOUR CHANGE URGENT?  

Help us prioritize incoming PRs by letting us know when the change needs
to go live.
- [ ] Urgent deadline (GA date, etc.): 
- [x] Other deadline: 2025-06-21 ideally since that gives us a month of
notice, but any time before Jul 2025-07-14 is probably fine
- [ ] None: Not urgent, can wait up to 1 week+

## SLA

- Teamwork makes the dream work, so please add a reviewer to your PRs.
- Please give the docs team up to 1 week to review your PR unless you've
added an urgent due date to it.
Thanks in advance for your help!

## PRE-MERGE CHECKLIST

*Make sure you've checked the following before merging your changes:*

- [x] Checked Vercel preview for correctness, including links
- [x] PR was reviewed and approved by any necessary SMEs (subject matter
experts)
- [x] PR was reviewed and approved by a member of the [Sentry docs
team](https://github.com/orgs/getsentry/teams/docs)

---------

Co-authored-by: Alex Krawiec <alex.krawiec@sentry.io>

Author: keeakita

docs/security-legal-pii/security/ssl.mdx

@@ -44,7 +44,20 @@ This suite of protocols and ciphers represents Sentry's official support; howeve
 
 ## Certificate Pinning
 
-At the moment, Sentry uses Digicert and Let's Encrypt as certificate authorities for all TLS certificates. If this needs to be changed, we will publish an announcement on [status.sentry.io](https://status.sentry.io/).
+<Alert title="Note" level="warning">
+
+Starting on 2025-07-21, the following domains with certificates previously issued by DigiCert will be transitioned to being issued by Let's Encrypt:
+
+- `sentry.io`
+- `de.sentry.io`
+- `us.sentry.io`
+- `*.ingest.sentry.io`
+- `*.ingest.us.sentry.io`
+- `*.ingest.de.sentry.io`
+
+</Alert>
+
+At the moment, all Sentry TLS certificates use either Digicert or Let's Encrypt as certificate authorities. If this list of roots needs to be changed, we will publish an announcement on [status.sentry.io](https://status.sentry.io/).
 
 Here are corresponding root CA certificates if you would like to pin them in your applications: