Marketing Cloud Engagement | Frequently Asked Questions: Server Certificates and Certificate Renewals

Whether a certificate renewal affects your environment depends entirely on your client-side configuration. Salesforce Support cannot inspect the internal settings of your environment, and therefore cannot make individual determinations about whether your specific configuration will be affected or advise on exactly which settings to change.

To proactively prevent connectivity errors, the most reliable approach is to ensure that all devices accessing the servers subject to renewal (API clients or PCs) are configured to trust the full set of root certificates included in the Mozilla list, as recommended in this article. If this configuration is in place, certificate renewals will not cause connectivity issues. We appreciate your understanding and cooperation.

Reference:
Important Update for Marketing Cloud Engagement Customers: End of Support for Certificate Pinning
https://trailhead.salesforce.com/ja/trailblazer-community/feed/0D5KX00000KDKZw0AP

 

 

During SSL/TLS communication, the connecting client validates the authenticity of the server certificate. Validation is performed against three primary criteria: whether the certificate is within its validity period, whether it matches the domain of the server being connected to, and whether a trusted root Certificate Authority (CA) serves as the anchor of the certificate chain. If any of these conditions are not met, the SSL/TLS handshake fails and the HTTPS connection is terminated.

In MCE's standard certificate renewal process, the certificate presented is always valid and matches the appropriate domain. As a result, certificate expiry and domain mismatch are not typically a concern during renewals. Whether a connection succeeds after a renewal depends primarily on whether the client's trust store is configured to trust the root certificate that anchors the presented certificate chain.

[Note: Access via web browsers on general PCs and smartphones]
In this article, "client" refers not only to systems performing API integrations, but also to web browsers on general PCs and smartphones. However, mainstream operating systems and browsers automatically manage and update their root certificate lists through their respective vendors. Since MCE uses certificates from CAs that comply with Mozilla's policy, access from general users will not be disrupted as long as a Bring Your Own Certificate (BYOC) configuration is not in use for SAP domains.

 

If the server certificate is not recognized as valid (trusted) by the client — whether a browser or an API client — a secure TLS/SSL connection cannot be established, resulting in various errors. If connectivity issues arise, review the following based on the relevant endpoint.

 

Connection Target	Examples of Issues That May Occur	Verification and Resolution
1. API Endpoints	Requests from API clients fail at the connection level. TLS-related errors are recorded in the application logs on the API client side.	Contact the infrastructure administrator responsible for the API client environment. Verify that the root certificate of the target API server is registered as trusted in the API client's trust store.
2. Marketing Cloud Engagement Admin Console	Security warnings appear in the browser, pages do not render correctly, or certain features do not function as expected in the UI.	The certificate used by this service is trusted by standard operating systems and browsers. If this error occurs, it is likely that the trust store on the affected PC has been intentionally restricted, or that an intermediate network device (e.g., a proxy) is interfering. Configure the environment to trust the full certificate chain from the relevant root CA, or contact the team responsible for managing the PC and network.
3. SAP / Private Domain (Clicks, Views, Images, CloudPages, etc.)	Images in emails do not display, tracking links do not function, View as Web Page does not work, CloudPages are inaccessible, etc.	These endpoints are intended for access by general recipients. In standard user environments, the server certificate for SAP/Private Domain is trusted by default and this issue should not occur. However, issues may arise when accessing from environments with strict security configurations, such as certain corporate networks. If the issue is reproducible only from specific PCs or internal environments, the PC administrator or IT team should take the same steps as described in row 2 above.

The following configurations are defined as unsupported or not recommended in MCE, as they are likely to cause connectivity failures during certificate renewals (rotations).

This refers to a configuration in which the hash value of a specific server certificate or intermediate certificate is hardcoded within an application. Because MCE rotates certificates periodically as part of its security maintenance, this configuration will result in connection failures immediately after a certificate renewal.

Configurations that selectively allow only specific CAs from the standard root certificate list and maintain a custom whitelist (e.g., permitting DigiCert Global Root G1 only, while blocking G2/G3) are not recommended. When MCE changes the CA it uses (e.g., transitioning from G1 to G2), clients in this configuration will fail validation and become unable to connect. Trusting the full list of root certificates, rather than relying on specific ones, is recommended for stable operation.

 

To prevent connectivity errors when connecting to MCE, the following configuration is recommended.

MCE uses Certificate Authorities (CAs) that comply with Mozilla's policy. Therefore, for all client environments (Java, .NET, OpenSSL, browsers, etc.), we recommend and support a configuration that broadly trusts all root certificates included in Mozilla's list. By maintaining this configuration, trust relationships are automatically preserved even when root certificate generations change (e.g., G2, G3) or when the CA itself changes.

 

Q. Should I register DigiCert Global Root G2 or G3?
A. Please register all root certificates included in the Mozilla list comprehensively, including both G2 and G3. Restricting trust to a specific version constitutes a non-recommended configuration and may cause future connectivity errors.

 

Q. Will advance notice be provided before a certificate renewal? Can the certificate data be distributed in advance?
A. As a general rule, advance individual notification and pre-distribution of certificate data are not provided. If the recommended configuration is in place, certificate renewals will not impact connectivity, regardless of whether advance notice is given.

 

Q. Is pre-validation (connectivity testing) available?
A. A dedicated environment for certificate validation testing is not provided. Please prioritize verifying that the trust store in your client environment conforms to the recommended configuration.

 

Q. Are there any actions required by MCE administrators in connection with a server certificate renewal?
A. Except for SAP domains where customers bring their own SSL certificates (BYOC), no actions are required in the MCE admin console. For any configuration changes that may be needed on your own systems, please review this article and the applicable services subject to certificate renewal, then consult the server administrators for your API clients and the administrators responsible for your PCs and network.

 

Q. Where can I find information about the root CA used by MCE's server certificates?
A. Server certificate information can be verified using a standard web browser. The steps for Google Chrome are as follows:

To enable us to provide smooth and efficient support, please confirm the following two points internally before submitting a support request.