--- schema_version: "1" id: f10ac5180547de9bc1f6f10abc7749e21c16ebcd8629e896ab5a27446c6b17a2 title: Configure Crypto Settings for an eCDN Zone collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_configure_zone_crypto_settings.md canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_configure_zone_crypto_settings.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 4a7d7addd543b390b70708c8e1aafdb5182571fdf2da3b7af683e166b9da3fbd description: Configure SSL/TLS and cryptography settings for a B2C Commerce eCDN zone, including Transport Layer Security (TLS) version and HTTP Strict Transport Security (HSTS), using the Configure Zone screen in Business Manager. products: - Commerce - B2C Commerce release: "264" --- # Configure Crypto Settings for an eCDN Zone Configure SSL/TLS and cryptography settings for a B2C Commerce eCDN zone, including Transport Layer Security (TLS) version and HTTP Strict Transport Security (HSTS), using the Configure Zone screen in Business Manager. [Which Salesforce Commerce Product Do I Have?](https://help.salesforce.com/s/articleView?id=commerce.comm_what_product.htm&language=en_US) Use the Crypto tab to manage TLS, certificates, and HSTS for an eCDN zone. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png) Note If a tab doesn't fit on screen, it appears under a **More** dropdown on the right. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png) Note On SCAPI zones, the Crypto tab is read-only on the Production instance. The Certificates table is visible, but you can't change TLS 1.3, HSTS, or certificate settings. Salesforce manages certificates for SCAPI zones. The SCAPI zone doesn't appear in Business Manager or the CDN API on Development or Staging. See [SCAPI Zone Support for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_scapi_zone.htm&release=264.0.0&type=5 "A SCAPI zone is the Salesforce-managed eCDN zone that fronts Salesforce Commerce API (SCAPI) traffic. Starting with B2C Commerce 26.10, the Production instance includes a subset of eCDN security controls and analytics for this zone in Business Manager and the CDN API, with no support case required."). 1. In Business Manager, click the App Launcher, and then select **Administration** | **Sites** | **Embedded CDN Settings**. 2. Locate the zone you want to configure and select **Configure Zone** from the dropdown menu. 3. Select the **Crypto** tab. **Crypto tab — SSL/TLS settings and certificates** ![Configure Zones Crypto tab showing SSL/TLS Settings, Certificates list, HSTS Settings, and the Under Attack Mode toggle in the header.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_configure_zone_crypto_overview_v2.png) **Crypto tab — certificate detail expanded** ![Crypto tab Certificates section with a certificate row expanded to show validation method, type, hosts, issuer, signature, upload date, and minimum TLS version.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_configure_zone_crypto_certificate_details.png) 4. In the SSL/TLS Settings section, set **Enable TLS 1.3** on or off. TLS 1.3 is supported by all major browsers. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png) Note If your zone has no custom certificates, you can't change the TLS 1.2 minimum requirement. If you click the toggle, a confirmation appears and the toggle reverts. **TLS 1.3 setting in SSL/TLS Settings** ![SSL/TLS Settings section showing the Enable TLS 1.3 toggle with the state indicator in the Crypto tab.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_configure_zone_crypto_tls13.png) 5. Review certificates in the **Certificates** table. | Column | What it shows | | --- | --- | | Hostname | The hostname or wildcard covered by the certificate. | | Cert Status | Certificate state, such as Active, Active - Expires Soon, Pending, or Initializing. | | Hostname Status | Whether the hostname has been verified at the edge. | | Expires On | Certificate expiration date. | The first 12 certificates are shown. Click **View All** to see the rest. 6. Manage certificates as needed. 1. To add a certificate, click **New Certificate** and follow the prompts. 2. To replace or delete a certificate, open the actions menu on the certificate row, and then select **Edit** or **Delete**. A confirmation dialog appears before deletion. 3. To view certificate details, click the chevron at the start of a certificate row. The expanded view shows certificate type, hosts, issuer, validation method, expiration details, and any TXT or CNAME records or verification buttons required for unverified certificates. **Certificate details expanded in Certificates table** ![Certificates table with a row expanded to display additional certificate and hostname verification details.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_configure_zone_crypto_certificate_details.png) 7. Configure HSTS. 1. Expand the **HSTS Settings** section. 2. Set **Enable HSTS** on and, in the confirmation dialog, click **Enable**. The dialog explains the consequence before you continue. 3. Click the edit pencil and configure **Time and Unit**, **Include Subdomains**, and **Preload**. 4. Click **Save**. ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_important.png) Important HSTS can't be turned off manually. It expires only when the configured max age passes. Make sure your full site is served over HTTPS before enabling HSTS. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png) Note HSTS is opt-in and not enabled by default. If you don't see HSTS settings in the Crypto tab, contact your Salesforce representative. **HSTS settings with editable max-age options** ![HSTS Settings section showing enabled state, time value and unit, Include Subdomains, Preload options, and Save and Cancel actions.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_configure_zone_crypto_hsts_edit.png) **HSTS state indicators in Crypto tab** ![HSTS Settings showing the enabled toggle and edit icons for time and unit fields in the Crypto tab.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_configure_zone_crypto_hsts_enabled.png) **HSTS informational message when disabled** ![HSTS Settings with disabled state and informational banner explaining that HSTS expires after max age and can't be manually disabled.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_configure_zone_crypto_hsts_disabled.png) #### See Also - [eCDN Zone Security Rules](https://help.salesforce.com/s/articleView?id=cc.b2c_ecdn_security_rules.htm&release=264.0.0&type=5 "Use the Security Rules tab on the Configure Zone screen to protect a B2C Commerce embedded CDN (eCDN) zone with web application firewall (WAF) managed rulesets, realm and zone security rules, custom firewall rules, and rate limiting. Learn what each control does, which zone types are eligible, and how traffic from trusted sources bypasses security checks.")