How do I import an SSL certificate into Salesforce?

Importing an SSL certificate into Salesforce is crucial for securing your custom domains, enhancing trust, and ensuring data privacy. This process can be accomplished through the intuitive Salesforce Setup user interface for new setups or replacements, or programmatically using API commands for advanced management and updates.

Understanding SSL Certificates in Salesforce

An SSL (Secure Sockets Layer) or TLS (Transport Layer Security) certificate encrypts the connection between your users' browsers and your Salesforce-hosted custom domain (e.g., www.yourcompany.com, community sites, or customer portals). This ensures that data transmitted remains private and secure.

Enhances Security: Encrypts sensitive data exchanged between the user and your Salesforce instance, protecting against eavesdropping and tampering.
Builds Trust: Displays a padlock icon and "HTTPS" in the browser's address bar, signaling to users that your site is secure and trustworthy.
Improves SEO: Search engines like Google favor secure websites, potentially boosting your search engine rankings.

Methods for Importing/Uploading an SSL Certificate

Salesforce provides flexible options for managing your SSL certificates, catering to both interactive administrative tasks and automated processes.

Method 1: Importing via Salesforce Setup UI (Recommended for Most Users)

This method is the most common and user-friendly way to upload a new SSL certificate or replace an expiring one for your custom domains.

Steps to Upload a New SSL Certificate

Generate a Certificate Signing Request (CSR):
- In Salesforce, navigate to Setup.
- In the Quick Find box, type Certificate and select Certificate and Key Management.
- Click Create CA-Signed Certificate.
- Fill in the required fields (e.g., Label, Unique Name, Common Name matching your domain www.yourdomain.com). Select an appropriate Key Size (e.g., 2048).
- Save the certificate. This action generates a unique private key within Salesforce and allows you to download the CSR.
- Click Download Certificate Signing Request to save the .csr file.
Submit CSR to a Certificate Authority (CA):
- Purchase an SSL certificate from a trusted Certificate Authority (CA) such as DigiCert, Sectigo, GoDaddy, or Let's Encrypt.
- During the purchase process, you will be prompted to submit the .csr file you downloaded from Salesforce. The CA uses this CSR to generate your unique SSL certificate.
Receive Certificate Files from CA:
- Your CA will email you the issued SSL certificate files. This typically includes your primary certificate (.crt or .cer) and often one or more intermediate certificates, which form the "certificate chain." Ensure you download all provided files.
Upload Certificate to Salesforce:
- Return to Setup > Certificate and Key Management.
- Locate the pending certificate you created in step 1.
- Click Upload Signed Certificate.
- Browse and select the primary certificate file (e.g., yourdomain.crt) provided by your CA. Salesforce will automatically link it to the previously generated private key.
- Important: If your CA provided separate intermediate certificates, you might need to concatenate them into a single file or ensure your primary certificate file includes the full chain. Some CAs provide a single .p7b or .pem file that contains the entire chain, which simplifies the upload.

Activating the Certificate for a Custom Domain

After successfully uploading your certificate, you need to associate it with your custom domain:

From Setup, in the Quick Find box, type Domains and select Domains.
Click Add a Domain or edit an existing custom domain entry.
In the HTTPS Certificate dropdown, select the newly uploaded SSL certificate.
Review other domain settings and click Save.
Allow some time for the changes to propagate across Salesforce's network. You can monitor the domain's status in the Domains page. Once active, your custom domain will serve content securely over HTTPS.

Method 2: Programmatic Update Using Salesforce APIs (For Advanced Users/Automation)

For scenarios requiring automated certificate management, bulk updates, or integration with external systems, Salesforce provides API capabilities. This method is particularly useful for updating or replacing an existing certificate programmatically.

Using Salesforce CLI or API for Certificate Updates

This process involves identifying the certificate you wish to replace and then updating its properties with the new certificate data.

Get the Certificate ID: Use the getCertificates command or an equivalent API query (e.g., using SOQL via the Tooling API or REST API) to retrieve the unique ID of the certificate that needs to be replaced. This ensures you target the correct record for the update.
- Example (Conceptual API Query): You might query the Certificate object using SOQL to find its Id based on its DeveloperName or Label.
```
SELECT Id, DeveloperName, ExpirationDate FROM Certificate WHERE DeveloperName = 'MyCustomDomainCert'
```
Prepare the New Certificate Data: Have your new certificate file (e.g., .crt, .pem, or .pfx if it includes the private key) ready. Depending on the specific API call, you might need to encode this data (e.g., Base64).
Update the Certificate: Utilize the updateCertificate command or an equivalent API call (e.g., a PATCH request to the Certificate SObject endpoint in the REST API) to update the existing certificate record. This command will take the ID of the certificate to be updated and the new certificate data.
- This approach is ideal for automating the renewal process or updating certificates across multiple Salesforce orgs from a central management system. For detailed syntax and specific API endpoints, refer to the Salesforce Metadata API Developer Guide or the Salesforce Tooling API Developer Guide.

Key Considerations for SSL Certificate Management

Certificate Chain: Always include the full certificate chain (root and all intermediate certificates) provided by your CA when uploading. This ensures all browsers can validate your certificate.
Private Key Security: Salesforce securely manages the private key associated with your certificate. Never expose or share your private key.
Expiration Management: Keep track of certificate expiration dates. Salesforce displays these in Certificate and Key Management. Set up reminders or automate the renewal process to prevent service interruptions.
Wildcard Certificates: Consider using wildcard certificates (e.g., *.yourdomain.com) if you host multiple subdomains. A single wildcard certificate can secure all subdomains under your primary domain.
Testing: After importing and activating a new certificate, thoroughly test all affected custom domains and sites to confirm they load securely over HTTPS and all content is accessible.

Certificate Type	Primary Use Case	Salesforce Configuration Path
CA-Signed Certificate	Custom domains, Experience Cloud Sites, Salesforce Sites	Setup > Certificate and Key Management; Setup > Domains
Self-Signed Certificate	Internal testing, development environments	Setup > Certificate and Key Management
Wildcard Certificate	Multiple subdomains under a single root domain	Setup > Certificate and Key Management; Setup > Domains