---
schema_version: "1"
id: e9f247d5846e7be360a4f221f7f1ff5e7d6bd094ee0bbc0cdaa16e64cbb51e9e
title: Update a Self-Managed SSL Certificate
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_update_a_zones_self_managed_certificate.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_update_a_zones_self_managed_certificate.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: fac6a5e904ac6fef1ffc4abc616f82cf69f7bb1a6f2699bc167e278b67edaab9
description: When your self-managed SSL certificate expires, or you update the hostnames assigned to a self-managed SSL certificate, upload a replacement certificate in Business Manager for B2C Commerce and remap DNS.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Update a Self-Managed SSL Certificate

When your self-managed SSL certificate expires, or you update the hostnames assigned to a self-managed SSL certificate, upload a replacement certificate in Business Manager for B2C Commerce and remap DNS.

[Which Salesforce Commerce Product Do I Have?](https://help.salesforce.com/s/articleView?id=commerce.comm_what_product.htm&language=en_US)

For the DNS mapping rules and validation methods, see [DNS Mapping for eCDN Zones](https://help.salesforce.com/s/articleView?id=cc.b2c_dns_mapping_for_ecdn_zones.htm&release=264.0.0&type=5 "To route a hostname's traffic through its embedded CDN (eCDN) zone, map DNS from your provider to the zone and validate the zone's SSL certificate. Understand the mapping rules, validation methods, and certificate limits before you add or update a certificate.").

To renew a self-managed certificate with the CDN Zones API instead, see [eCDN Custom Certificates](https://developer.salesforce.com/docs/commerce/commerce-api/guide/cdn-zones-custom-certs.html#renew-a-custom-certificate) in the developer documentation.

To update the hostnames assigned to a certificate in a proxy zone, add a new certificate with all the hostnames, verify the hostnames, and then delete the old certificate. Adding all hostnames before you delete the old certificate avoids availability gaps.

For wildcard hostnames with self-managed certificates, include SANs for both the wildcard and root domains. See [Configure Wildcard Custom Hostnames](https://help.salesforce.com/s/articleView?id=cc.b2c_add_wildcard_custom_hostname.htm&release=264.0.0&type=5 "Use a single wildcard custom hostname (for example, *.merchantsite.com) to cover multiple subdomains and reduce onboarding and management overhead in B2C Commerce eCDN via Business Manager.").

1. In Business Manager, click App Launcher ![App Launcher](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/appLauncher.png), and then select **Administration** | **Sites** | **Embedded CDN Settings**.
2. Select a zone from the hostnames list and click **Certificate**.
3. On the Crypto tab, select the zone from the list.
    
    To view certificate details, click the chevron at the start of a certificate row. The expanded view shows certificate type, hosts, issuer, validation method, expiration details, and any TXT or CNAME records or verification actions required for unverified certificates.
4. From the certificate row actions menu, click **Edit** on the certificate you want to update.
    
    To remove a certificate instead, click **Delete**. A confirmation appears before deletion.
5. Select **Self-Managed Certificate**.
6. Click **Update Certificate**.
7. Paste the certificate and private key information from your Certificate Authority provider.
8. Select the hostname to which you want to assign the SSL certificate.
9. Click **Replace Certificate**.
    
    ![Replace Custom Certificate dialog with Self-Managed Certificate selected, showing certificate and private key fields with assigned hostname details](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_self_managed_cert_update.png)
10. Copy the displayed verification text into your own DNS portal.
11. To check the status of hostname validation, click **Verify HostName**.
    
    Verification can take up to six hours.
12. Map DNS so that the hostname's traffic routes to its zone.
    
    See [Map DNS to an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_map_dns_to_ecdn_zone.htm&release=264.0.0&type=5 "After a hostname is active, map DNS at your provider so that the hostname's traffic routes to its embedded CDN (eCDN) zone. Use this procedure whenever you add or update a certificate for a zone.").