--- schema_version: "1" id: cecbdce2ae9af6e71c83cc1b0f3595cff35db7e56586759dcd5c88c02b9a4f15 title: Update a Managed SSL Certificate collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_update_a_zones_managed_certificate.md canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_update_a_zones_managed_certificate.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: f19b8a38147ca1448699aed7b6e45c6a07bf83a9ec830f0c3a15853f1e0cd64c description: When your managed SSL certificate expires, or you update the hostnames assigned to a managed SSL certificate, update the certificate in Business Manager for B2C Commerce. products: - Commerce - B2C Commerce release: "264" --- # Update a Managed SSL Certificate When your managed SSL certificate expires, or you update the hostnames assigned to a managed SSL certificate, update the certificate in Business Manager for B2C Commerce. [Which Salesforce Commerce Product Do I Have?](https://help.salesforce.com/s/articleView?id=commerce.comm_what_product.htm&language=en_US) For the DNS mapping rules and validation methods, see [DNS Mapping for eCDN Zones](https://help.salesforce.com/s/articleView?id=cc.b2c_dns_mapping_for_ecdn_zones.htm&release=264.0.0&type=5 "To route a hostname's traffic through its embedded CDN (eCDN) zone, map DNS from your provider to the zone and validate the zone's SSL certificate. Understand the mapping rules, validation methods, and certificate limits before you add or update a certificate."). To update the hostnames assigned to a certificate in a proxy zone, add a new certificate with all the hostnames, verify the hostnames, and then delete the old certificate. Adding all hostnames before you delete the old certificate avoids availability gaps. To switch a hostname from a self-managed (custom) certificate to an eCDN managed certificate, use the CDN Zones API `updateCertificate` method with the certificate type set to `automatic`. See [updateCertificate](https://developer.salesforce.com/docs/commerce/commerce-api/references/cdn-api-process-apis?meta=updateCertificate). 1. In Business Manager, click App Launcher ![App Launcher](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/appLauncher.png), and then select **Administration** | **Sites** | **Embedded CDN Settings**. 2. Select a zone from the hostnames list and click **Certificate**. 3. On the Crypto tab, select the zone from the list. To view certificate details, click the chevron at the start of a certificate row. The expanded view shows certificate type, hosts, issuer, validation method, expiration details, and any TXT or CNAME records or verification actions required for unverified certificates. 4. From the certificate row actions menu, click **Edit** on the certificate you want to update. 5. Select **eCDN Managed Certificate**. ![Replace Custom Certificate dialog with eCDN Managed Certificate selected, showing certificate details and assignment details for an assigned hostname](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_managed_cert_update.png) 6. From the SSL Certificate Authority dropdown, select **Lets Encrypt** (default) or **Google**. 7. From the Certificate Validation Method dropdown, select **HTTP Validation** (recommended) or **TXT validation**. 8. Select the hostname to which you want to assign the SSL certificate. 9. Click **Replace Certificate**. 10. Copy the verification text for your chosen validation method into your own DNS portal. - **HTTP Validation** (recommended): Copy the displayed hostname verification text. ![Certificates table showing hostname with Initiating status and hostname TXT validation values to copy](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_enter_host_name.png) - **TXT Validation**: Copy the displayed certificate and hostname TXT verification text, including the DCV Delegation CNAME. ![Certificates table showing hostname with Pending Validation status and certificate TXT and hostname TXT values to copy, plus DCV Delegation CNAME](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_enter_host_name_txt.png) ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png) Note Wildcard hostnames use TXT validation and can renew automatically with DCV delegation. For details, see [Configure Wildcard Custom Hostnames](https://help.salesforce.com/s/articleView?id=cc.b2c_add_wildcard_custom_hostname.htm&release=264.0.0&type=5 "Use a single wildcard custom hostname (for example, *.merchantsite.com) to cover multiple subdomains and reduce onboarding and management overhead in B2C Commerce eCDN via Business Manager."). 11. To check the status of hostname validation, click **Verify HostName**. Verification can take up to six hours. 12. (TXT validation only) After the hostname is active, click **Verify eCDN Managed Certificate** to validate the certificate through the TXT record. Verification can take up to six hours. 13. Map DNS so that the hostname's traffic routes to the new zone. See [Map DNS to an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_map_dns_to_ecdn_zone.htm&release=264.0.0&type=5 "After a hostname is active, map DNS at your provider so that the hostname's traffic routes to its embedded CDN (eCDN) zone. Use this procedure whenever you add or update a certificate for a zone."). After the CNAME record points traffic to the new zone, click **Verify eCDN Managed Certificate** to check the certificate validation status. Verification can take up to six hours.