You are here:
Manage Expired Certificates
When you’re notified that a certificate authority (CA) or self-signed certificate is expiring, or when your org no longer needs a certificate, manage certificate deletion appropriately.
Required Editions
| Available in: both Salesforce Classic and Lightning Experience |
| Available in: all editions |
| User Permissions Needed | |
|---|---|
| To create, edit, and manage certificates: | Customize Application |
Disposing expiring certificates in the right way helps prevent service disruptions due to inadequate security coverage. Before you delete a certificate, make sure that it isn’t used for any integrations or for single sign-on.
To comply with new CA/Browser Forum recommendations, certificate shelf life is being reduced. See Certificates in Salesforce to learn more.
Important If the expiring certificate is the identity provider, single
sign-on (SSO) doesn’t work after you delete it, and users must log in using their org
credentials. To keep it easy for users to log in, reassign the identity provider to another
certificate.
- From Setup, use the Quick Find box to find and select Certificate and Key Management.
- Each certificate is listed with its expiration date. To find the full certificate record, click the Edit link.
- On the certificate info page, the Delete button is unavailable if an identity provider is using it. To confirm its availability, hover over the Delete option to display the identity provider status message.
- Write down the value for the expiring certificate’s Label.
- From Setup, use the Quick Find box to find and select Identity Provider.
- Verify that the label you wrote down is identical to the label in the Currently chosen certificate details section.
- Verify that no records are listed under the Service Providers section of the page. If there’s a service provider listed, upload a new certificate to replace the expiring one.
- With no service providers listed, click the Disable button at the top of the page.
- Return to the Certificate and Key Management page.
- The expired certificate has been released. To delete it, click the Del link on the Certificate and Key Management page. Or, click the Edit link to navigate to the full certificate record, and then click Delete
If necessary, upload or create another CA or self-signed certificate to replace the one that you deleted.
Did this article solve your issue?
Let us know so we can improve!
