Marketing Cloud Engagement SSL Certificates Overview

What is an SSL certificate and why do I need it? 

SSL certificates keep online interactions private even though they travel across the public Internet, and they give your visitors the confidence to transact with your website. SSL validates site identity and secures data in transit. All Marketing Cloud Engagement domains are secured by default with SSL before use.
 

Which domains should be secured?

SSL Setup

.

1.  Purchase SSL SKUs for your Marketing Cloud Engagement account

SSL isn’t included with Sender Authentication Package (SAP), but you can purchase it to secure the domain types listed in the preceding section. For existing customers, your domains are secured on your behalf. When you renew your contract, you must purchase SSL SKUs to address any usage that exceeds your entitlements. New customers must obtain four SSL SKUs for SAP and one SSL SKU for each additional CloudPages domain.

2.  Certificates can be issued in two ways:

a. Salesforce purchases the SSL certificate on your behalf via DigiCert or Amazon.
b. You provide your own certificate. This option isn't supported for image subdomains.

We recommend allowing Salesforce to purchase the certificate on your behalf. This option has the quickest turnaround, and makes renewal seamless.

Even if you supply your own certificate, you must purchase an SSL SKU.

3. Secure your domain.

If you plan to use Salesforce-provided certificates, use the Domain SSL Certificates page in Marketing Cloud Engagement Setup to secure your domain.  Find detailed usage guidelines in Secure a Custom Domain and Secure a Domain Using a Custom SSL Certificate.

DNS Considerations

.

CAA records control the list of certificate authorities (CAs) allowed to issue certificates on behalf of a domain. When no CAA records exist, all CAs can issue on a domain's behalf. When any CAA record exists, the CAs allowed to issue on behalf of that domain and its children are limited to those explicitly allowed by these records. 

If CAA records exist and Salesforce-supplied certificates are used to secure custom domains on self-hosted DNS, ensure these record are in place:

<SAP domain> CAA 0 issue "digicert.com"
<SAP domain> CAA 0 issue "amazon.com"

Record should be inserted at the SAP domain level or higher. 

Restrictive CAA records can be inserted by network admins without the knowledge of Marketing Cloud SAP owners. If you use Salesforce-supplied certificates, make sure that your admins are aware so that CAA record updates are made in accommodation of this requirement.

Additional Information

.

• Marketing Cloud Engagement issues single-domain certificates for click, view, and cloud subdomains. Multi-domain SAN certificates are issued for image subdomains.
• For CloudPages that were created before SSL was implemented, a redirect will not be forced for HTTP versions of the URL that exists to push navigation to the HTTPS version of the URL. In the CloudPages application, there is an option to update SSL for existing pages to HTTPS within Page Details.
• Each SSL SKU secures a single hostname. In Marketing Cloud Engagement, SAP domain refers to a collection of hostnames (subdomains) used to provide the product's functionality. SAP hostnames that should be secured with SSL include the click, view, image, and cloud subdomains. Thus, 4 SSL SKUs are most commonly used to secure a SAP domain.