Loading
Feature degradation | Gmail Email delivery failureRead More
Extend Salesforce with Clicks, Not Code
Table of Contents
Filter by (0)Add
Select Filters

          No results
          No results
          Here are some search tips

          Check the spelling of your keywords.
          Use more general search terms.
          Select fewer filters to broaden your search.

            Search all of Salesforce Help
            Search all of Salesforce Help
            Update an Expiring Certificate for Your Custom Domain

            You are here:

            1. Salesforce Help
            2. Docs
            3. Extend Salesforce with Clicks, Not Code

            Update an Expiring Certificate for Your Custom Domain

            If you serve your domain with your HTTPS certificate on Salesforce servers, avoid disruption to your domain by renewing or replacing your certificate before it expires. You can find the expiration date for your HTTPS certificates on the Certificate and Key Management Setup page. Also, admins receive an expiring certificate notification email before the certificate expires.

            Required Editions

            Available in: both Salesforce Classic and Lightning Experience
            Available in: Enterprise, Performance, and Unlimited Editions.
            Applies to: Salesforce Sites and LWR, Aura, and Visualforce sites
            User Permissions Needed
            To create, edit, and manage certificates: Customize Application
            To edit a domain: Manage Custom Domains
            Note
            Note These instructions apply only to certificates for custom domains that you serve with your HTTPS certificate on Salesforce servers. If your custom domain uses the Salesforce content delivery network (CDN) to serve your Digital Experiences, our CDN partner automatically renews the certificate. If a third-party service or CDN serves your domain, work with that third party to make sure that your certificates remain valid.

            Unfamiliar with terms like DNS and certificate? See Custom Domain Terminology.

            By default, when you generate a certificate authority (CA)-signed HTTPS certificate in Salesforce, that certificate expires in a year, after which the certificate isn’t trusted. If you serve your site with a certificate that you uploaded to your Experience Cloud site, that certificate also expires periodically. To avoid downtime and allow time for testing, update your certificate at least one week before the certificate expires.

            1. Download your existing certificate.
              It’s a good idea to save a copy of any key before you delete it. If there’s an issue after you delete a certificate, you can import the key later.
              1. From Setup, in the Quick Find box, enter Certificate and Key Management, and then select Certificate and Key Management.
              2. In the Label column, select the certificate to download.
              3. On the Certificate and Key Detail page, select Download Certificate.
              4. Save the *.crt file to a safe location.
            2. Create and upload a new certificate to Salesforce.
              Although it’s technically possible to update your existing certificate, we recommend that you create a certificate in Salesforce when your certificate is about to expire. This approach increases the security of your certificate because adding a certificate generates a new public-private key pair for encryption
              1. If your CA uses intermediate certificates, see the instructions in the knowledge article, Merge a complete certificate chain for custom HTTPS domains.
              2. To upload your certificate to Salesforce, see Generate a Certificate Signed by a Certificate Authority. You can get the required CA signature as a part of that process.
              3. To import an existing certificate that is already signed, see the knowledge article, Use HTTPS certificate that exists within your Community domain.
            3. To use the new certificate, update your custom domain.
              1. From Setup, in the Quick Find box, enter Domains, and then select Domains.
              2. Next to your domain, select Edit.
              3. Under the domain configuration option, serve the domain with your HTTPS certificate on Salesforce servers, and clear the certificate field. Then select the lookup icon (The lookup icon).
                Domain Edit screen with the certificate field circled.
              4. In the lookup window, select the label of the new certificate.
              5. Save your changes.
              It can take up to 4 hours for the updated certificate to take effect.
            4. Validate your domain.
              Because it can take up to 4 hours for the change to take effect, we recommend that you validate your domain both after you save your changes and then again the next day.
            5. Optionally, delete your old certificate.
              1. From Setup, in the Quick Find box, enter Certificate and Key Management, and then select Certificate and Key Management.
              2. For the expired certificate, select Del.
                This option is available only when no domain, identity provider, single sign-on (SSO) setting, or connected app uses the certificate.

            See Also

             
            Loading
            Salesforce Help | Article