---
schema_version: "1"
id: 1cbbb1d413eb851b139233d31c0d686f2d2e569affd15721b3b3771768b79b53
title: Secure a Domain Using a Custom SSL Certificate
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/mktg/264-0-0/mc_overview_custom_domain_ssl_certificate.md
canonical_url: https://help.salesforce.com/s/articleView?id=mktg.mc_overview_custom_domain_ssl_certificate.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: f8e4fdcce7c0ab5121708e2d74eff4ed821f5fdec53138658e2b840bbfbb62bd
description: You can obtain an SSL certificate for Marketing Cloud Engagement from a certificate authority (CA). The CA that you use must let you use your own certificate signing request (CSR) rather than generate one for you. Image domains don’t support customer-supplied certificates, because the service is delivered from a shared infrastructure that uses common certificates. Salesforce uses DigiCert and Amazon as the certificate authorities.
products:
  - Marketing
  - Marketing Cloud Engagement
release: "264"
---
# Secure a Domain Using a Custom SSL Certificate

You can obtain an SSL certificate for Marketing Cloud Engagement from a certificate authority (CA). The CA that you use must let you use your own certificate signing request (CSR) rather than generate one for you. Image domains don’t support customer-supplied certificates, because the service is delivered from a shared infrastructure that uses common certificates. Salesforce uses DigiCert and Amazon as the certificate authorities.

1. From Setup, in the Quick Find box, enter ssl, and then select **Domain SSL Certificates**.
2. Next to the domain that you want to secure, click the action arrow.
    - To use a new certificate, select **Secure This Domain**.
    - To update a certificate, select **Renew Certificate**.
    - To use a Salesforce-provided certificate, select **Salesforce-Supplied Certificate**.
3. On the Confirm Secure Domain Settings page, enter an admin email address and select **Customer-Supplied Certificate**.
4. On the Generate Certificate Signing Request (CSR) page, enter the registration details for your organization.
5. Confirm the registration details.
6. On the Download Your CSR page, click **Download CSR**.
7. Obtain an SSL certificate from your preferred CA. The process of obtaining the certificate varies depending on which CA you use.
    
    ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-mktg-mc_marketing_cloud_overview-264-0-0-production-enus/2555afdb-8049-4e3c-8043-0e04803e5f16/images/icon_important.png)
    
    Important After you download the CSR, note the expiration date. Obtain the certificate from your CA before the CSR expires.
8. On the Upload Certificate page, upload your certificate in .p7b or .pem format. If your certificate is in .pem format, also upload a trust chain file in .pem format.
9. Confirm the domain certificate details.

You can check the status of the verification process on the Domain SSL Certificates page. It can take up to 72 hours for the process to complete.

#### See Also

- [Secure a Domain with an SSL Certificate Supplied by Salesforce](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_custom_domains.htm&release=264.0.0&type=5 "Secure a Sender Authentication Package (SAP) or CloudPages custom domain in Marketing Cloud Engagement using an SSL certificate provided by Salesforce.")