--- schema_version: "1" id: d216693c417be92f682e162986d6659b70c2e37f470dd431982735a6abda8710 title: Add a Managed SSL Certificate for B2C Commerce collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_add_managed_ssl_certificates.md canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_add_managed_ssl_certificates.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: c1e8b55b31e2b8c4a74bb0d7ad0f00b9443494faafef728a7108c7fa1e60ccca description: Add an eCDN managed SSL certificate to a hostname for a zone, validate it, and map DNS so the hostname's traffic routes to its zone. eCDN managed certificates are issued and auto-renewed by Salesforce. products: - Commerce - B2C Commerce release: "264" --- # Add a Managed SSL Certificate for B2C Commerce Add an eCDN managed SSL certificate to a hostname for a zone, validate it, and map DNS so the hostname's traffic routes to its zone. eCDN managed certificates are issued and auto-renewed by Salesforce. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png) Note Managed SSL certificates aren't available on SCAPI zones. Salesforce manages the SCAPI hostname and certificates. See [SCAPI Zone Support for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_scapi_zone.htm&release=264.0.0&type=5 "A SCAPI zone is the Salesforce-managed eCDN zone that fronts Salesforce Commerce API (SCAPI) traffic. Starting with B2C Commerce 26.10, the Production instance includes a subset of eCDN security controls and analytics for this zone in Business Manager and the CDN API, with no support case required."). [Which Salesforce Commerce Product Do I Have?](https://help.salesforce.com/s/articleView?id=commerce.comm_what_product.htm&language=en_US) For the DNS mapping rules, validation methods, and certificate limits, see [DNS Mapping for eCDN Zones](https://help.salesforce.com/s/articleView?id=cc.b2c_dns_mapping_for_ecdn_zones.htm&release=264.0.0&type=5 "To route a hostname's traffic through its embedded CDN (eCDN) zone, map DNS from your provider to the zone and validate the zone's SSL certificate. Understand the mapping rules, validation methods, and certificate limits before you add or update a certificate."). To add an eCDN managed certificate with the CDN Zones API instead, see [eCDN Automatic Certificates](https://developer.salesforce.com/docs/commerce/commerce-api/guide/cdn-zones-automatic-certs.html) in the developer documentation. 1. Click App Launcher ![App Launcher](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/appLauncher.png), and then select **Administration** | **Sites** | **Embedded CDN Settings**. 2. Click **Certificates** or **Settings** for the zone to which you're adding a certificate. 3. On the Crypto tab, select the zone from the list. 4. Click **New Certificate**. 5. Select **eCDN Managed Certificate**. An eCDN managed certificate uses the **automatic** certificate type: Salesforce issues and renews it for you. ![Upload Custom Certificate dialog with eCDN Managed Certificate selected, showing certificate details and assignment details](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_managed_cert.png) 6. From the SSL Certificate Authority dropdown, select **Lets Encrypt** or **Google** (recommended). 7. From the SSL Certificate Validation Method dropdown, select **HTTP Validation** or **TXT validation**. Choose HTTP validation without a stacked CDN, or TXT validation with a stacked CDN and DCV delegation. For the details and requirements of each method, see [DNS Mapping for eCDN Zones](https://help.salesforce.com/s/articleView?id=cc.b2c_dns_mapping_for_ecdn_zones.htm&release=264.0.0&type=5 "To route a hostname's traffic through its embedded CDN (eCDN) zone, map DNS from your provider to the zone and validate the zone's SSL certificate. Understand the mapping rules, validation methods, and certificate limits before you add or update a certificate."). 8. Select the hostname to which you want to assign the SSL certificate. 9. Click **Upload Certificate**. 10. Copy the displayed verification text into your own DNS portal. - **HTTP validation:** Copy the displayed hostname verification text. ![Certificates table showing hostname with Initiating status and hostname TXT validation values to copy](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_enter_host_name.png) - **TXT validation:** Copy the displayed certificate and hostname TXT verification text, including the DCV Delegation CNAME. ![Certificates table showing hostname with Pending Validation status and certificate TXT and hostname TXT values to copy, plus DCV Delegation CNAME](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_enter_host_name_txt.png) 11. To check the status of hostname validation, click **Verify HostName**. Verification can take up to six hours. 12. (TXT validation only) After the hostname is active, click **Verify eCDN Managed Certificate** to validate the certificate through the TXT record. Verification can take up to six hours. 13. Map DNS so that the hostname's traffic routes to its zone. See [Map DNS to an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_map_dns_to_ecdn_zone.htm&release=264.0.0&type=5 "After a hostname is active, map DNS at your provider so that the hostname's traffic routes to its embedded CDN (eCDN) zone. Use this procedure whenever you add or update a certificate for a zone."). After the CNAME points traffic to the new zone, click **Verify eCDN Managed Certificate** to check the certificate validation status.