--- schema_version: "1" id: 2090091d98c5a08841a6b40f8336ba97f6b90d524b0b9807d9f1064d4844310d title: Manage SSL Certificates for eCDN Zones in B2C Commerce collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_manage_ssl_certificates_for_ecdn_zones.md canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_manage_ssl_certificates_for_ecdn_zones.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: b961cfc58c86c141c155fa4c37235bc4c7a5993ef800ddf2e39998aa466f816c description: Every embedded CDN (eCDN) zone requires a valid SSL certificate. Proxy zones can use either an eCDN managed certificate that's issued and auto-renewed by Salesforce or a self-managed certificate that you upload and renew yourself in Business Manager before it expires. Legacy (root) zones, for example, brand.com, support only a self-managed certificate. After adding or updating a certificate, map DNS so the hostname's traffic routes to its eCDN zone. products: - Commerce - B2C Commerce release: "264" --- # Manage SSL Certificates for eCDN Zones in B2C Commerce Every embedded CDN (eCDN) zone requires a valid SSL certificate. Proxy zones can use either an eCDN managed certificate that's issued and auto-renewed by Salesforce or a self-managed certificate that you upload and renew yourself in Business Manager before it expires. Legacy (root) zones, for example, brand.com, support only a self-managed certificate. After adding or updating a certificate, map DNS so the hostname's traffic routes to its eCDN zone. [Which Salesforce Commerce Product Do I Have?](https://help.salesforce.com/s/articleView?id=commerce.comm_what_product.htm&language=en_US) ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png) Note Hostname and certificate management isn't available on SCAPI zones. Salesforce manages the SCAPI hostname and certificates. The Crypto tab for a SCAPI zone is read-only. See [SCAPI Zone Support for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_scapi_zone.htm&release=264.0.0&type=5 "A SCAPI zone is the Salesforce-managed eCDN zone that fronts Salesforce Commerce API (SCAPI) traffic. Starting with B2C Commerce 26.10, the Production instance includes a subset of eCDN security controls and analytics for this zone in Business Manager and the CDN API, with no support case required."). ## Certificates in Legacy and Proxy Zones A legacy zone and a proxy zone for the same hostname can't co-exist in the same realm and Cloudflare account. When the same hostname (for example, `us.brand.com`) is served from both a root zone (`brand.com`) and an eCDN proxy zone (ending in `cc-ecdn.net`), you must have a valid certificate in _both_ zones. If either certificate expires, or the proxy zone is missing the hostname, that zone can't serve traffic. Upload a valid certificate or use an eCDN managed auto-renewing certificate. - **[DNS Mapping for eCDN Zones in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_dns_mapping_for_ecdn_zones.htm&release=264.0.0&type=5)** To route a hostname's traffic through its embedded CDN (eCDN) zone, map DNS from your provider to the zone and validate the zone's SSL certificate. Understand the mapping rules, validation methods, and certificate limits before you add or update a certificate. - **[Map DNS to an eCDN Zone for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_map_dns_to_ecdn_zone.htm&release=264.0.0&type=5)** After a hostname is active, map DNS at your provider so that the hostname's traffic routes to its embedded CDN (eCDN) zone. Use this procedure whenever you add or update a certificate for a zone. - **[Add a Managed SSL Certificate for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_add_managed_ssl_certificates.htm&release=264.0.0&type=5)** Add an eCDN managed SSL certificate to a hostname for a zone, validate it, and map DNS so the hostname's traffic routes to its zone. eCDN managed certificates are issued and auto-renewed by Salesforce. - **[Add a Self-Managed SSL Certificate for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_add_self_managed_ssl_certificates.htm&release=264.0.0&type=5)** Add a self-managed SSL certificate to a hostname for a zone, validate it, and map DNS so the hostname's traffic routes to its zone. You upload and renew self-managed certificates yourself. - **[Update a Managed SSL Certificate](https://help.salesforce.com/s/articleView?id=cc.b2c_update_a_zones_managed_certificate.htm&release=264.0.0&type=5)** When your managed SSL certificate expires, or you update the hostnames assigned to a managed SSL certificate, update the certificate in Business Manager for B2C Commerce. - **[Update a Self-Managed SSL Certificate](https://help.salesforce.com/s/articleView?id=cc.b2c_update_a_zones_self_managed_certificate.htm&release=264.0.0&type=5)** When your self-managed SSL certificate expires, or you update the hostnames assigned to a self-managed SSL certificate, upload a replacement certificate in Business Manager for B2C Commerce and remap DNS. - **[Update Authoritative DNS for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_update_auth_dns.htm&release=264.0.0&type=5)** Point your B2C Commerce storefront's DNS records at your embedded CDN (eCDN) zone. Get the DNS CNAME record value from the `getZonesInfo` name property or from Business Manager, and then update the record with your authoritative DNS provider. #### See Also - [Shared Responsibility Model](https://help.salesforce.com/s/articleView?id=cc.b2c_shared_responsibility_model.htm&release=264.0.0&type=5 "B2C Commerce sites and platforms are attractive cyber attack targets. Cyber attackers look for locations where they can try to exfiltrate sensitive data, such as credit cards, personally identifiable information (PII), and credentials. The ordering workflow also offers an attractive attack surface for cybercriminals to try to enrich themselves. They can create fake orders, adjust coupons and promotions, and deny service to legitimate customers.")