Run Your Salesforce Experience Cloud Site under a Custom Domain

1) Update your DNS Server With Your Custom Domain

Let's say your company website runs under www.mycompany.com. Your company owns that domain name, and probably controls the DNS server that directs traffic to any domain under mycompany.com.
 

Your company's DNS server must be updated to point requests for site.mycompany.com at your site. This is done by using a CNAME record in your DNS server. Think of a CNAME as an alias, one where we're telling anyone looking for site.mycompany.com to look for your site address instead.
 

Many DNS servers (including those hosted by popular DNS name registrars like NameCheap and GoDaddy) provide a nice graphical way to update DNS settings, including CNAMEs.
 

Your DNS provider needs an alias to point your new domain name to. With Experience Cloud, CNAME aliases are supported with the following pattern:

• [domain].[18 character OrgID].live.siteforce.com.
• Note: The 18 character OrgID defines the case-sensitive nature of the characters used for the last characters of the OrgID

Find your organization's alias:

• In Salesforce Classic: Click New under Setup | Domain Management | Domains
• In Salesforce Lightning: Click New under Setup | User Interface | Sites and Domains | Domains

Note: 

• You won’t be able to save this domain in Salesforce until your CNAME record has propagated across the DNS system. This can take up to 24 hours.
• My Domain is a different area of functionality from Digital Experiences. My Domain brands the URLs that your internal organization uses to log into your org. Digital Experiences provide sites that external users can access.

2) Create a Certificate Signing Request & Obtain an SSL Certificate for your domain

In order to serve site content over encrypted connections (a requirement for any area of your site where someone must be logged in), you need to have your site host and serve an SSL certificate that matches the domain.
 

Many organizations offer SSL certificates for sale, including most common DNS registrars. Contact your IT department to obtain a CA-signed SSL certificate for your new site domain. That process starts by creating a Certificate Signing Request, or CSR.
 

Create a CSR within Salesforce:

1. Access 'Certificate and Key Management':
   • In Salesforce Classic: Click Setup | Security Controls | Certificate and Key Management
   • In Salesforce Lightning: Click Setup | Security | Certificate and Key Management
2. Create a Certificate record with your values for Common Name, Company, and other relevant fields.
   • Note: Ensure that you use a Certificate with a field size of 2048.
3. After you've created this record, you’ll be taken to a screen where you can download your CSR. Click Download Certificate Signing Request and share it with the concerned team. 
4. Follow Generate a Certificate Signed by a Certificate Authority create a CA signed certificate and download. 

You (or your IT department) use the CSR with an SSL certificate provider to generate an SSL cert for your domain. Certificate Authorities have differing methods of verifying information and issuing certificates, so you need to work with your IT department to get the appropriate certificate issued.

Note: You may use either a wildcard certificate (*.mycompany.com) or a domain-specific certificate (for example: site.mycompany.com) for your site.

3) Update your signed SSL certificate in Salesforce

After your certificate authority has issued your certificate, navigate back to the certificate record in Salesforce and click Update Signed Certificate to get your certificate into the system.

Note:

• Your Certificate Authority may issue you several files as part of the certificate. It's important to have a single file with the entire certificate chain (from the root to your domain cert) in the correct order. Your IT department can help you get this in place before you upload.
• SSL certificates may take up to 1 hour to propagate onto Salesforce infrastructure.

4) Create a Custom Domain in Salesforce

After your newly created CNAME propagates across the internet, you’ll be able to create a custom domain record in Salesforce:

1. Make sure all steps in section 3 are complete and the certificate is active to ensure that your site serves the appropriate certificate when encrypted connections are made.
2. Access 'Domain Management':
   • In Salesforce Classic: Click Setup | Domain Management | Domains
   • In Salesforce Lightning: Click Setup | User Interface | Sites and Domains | Domain 
3. Enter your Domain name (for example: site.mycompany.com)
4. Associate the correct Certificate from Certificate and Key field.