---
schema_version: "1"
id: 3fffade20779766e166f4ff62d173426ca535ec4cc63a5fd2abfd4d1896b67d9
title: Set Up a Custom Domain That Uses Your HTTPS Certificate
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/domain_mgmt_cert_setup.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_cert_setup.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: ea2e4c4d7de782d198c1b5d50a68325ee00f4871c8fb9ee57a7ec766d45b9d8d
description: Upload an HTTPS certificate that you own to Salesforce servers, then serve your custom domain with that certificate. After you set up your domain in Salesforce, that domain can serve your Experience Cloud sites or Salesforce Sites.
products:
  - Salesforce Platform
  - Security
release: "264"
---
# Set Up a Custom Domain That Uses Your HTTPS Certificate

Upload an HTTPS certificate that you own to Salesforce servers, then serve your custom domain with that certificate. After you set up your domain in Salesforce, that domain can serve your Experience Cloud sites or Salesforce Sites.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions.</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Applies to: Salesforce Sites and <a href="https://help.salesforce.com/s/articleView?id=experience.exp_cloud_basics_glossary.htm&amp;language=en_US" target="_blank">LWR, Aura, and Visualforce sites</a></td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d78417e78">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d78417e78 ">To view a domain:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d78417e78 ">
              <p>Manage Custom Domains</p>
              <p>OR</p>
              <p style="margin-bottom:0;">View Setup and Configuration</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d78417e78 ">To add a domain:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d78417e78 ">
              <p>Manage Custom Domains</p>
              <p>OR</p>
              <p style="margin-bottom:0;">View Setup and Configuration plus either a Site.com Publisher license or Create and Set
                Up Experiences</p>
            </td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d78417e78 ">To edit or delete a domain:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d78417e78 ">Manage Custom Domains</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d78417e78 ">To add, edit, and delete custom URLs:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d78417e78 ">
              <p>Manage Custom Domains</p>
              <p>OR</p>
              <p style="margin-bottom:0;">View Setup and Configuration AND either Create
                and Set Up Experiences OR a Site.com Publisher license</p>
            </td>

          </tr>
        </tbody>
      </table>

Unfamiliar with terms like DNS, CDN, and CNAME? Want to review the difference between a DNS resolver and a certificate? See [Custom Domain Terminology](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_terms.htm&release=264.0.0&type=5 "Review the terms related to setting up a custom domain in Salesforce.").

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/images/icon_note.png)

Note To create and activate a custom domain in a sandbox, add the domain in the production org that owns the sandbox.

1. Complete the [prerequisites](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_cert_prereqs.htm&release=264.0.0&type=5 "Before you serve your domain with an HTTPS certificate that you own, confirm that this domain configuration option applies to your configuration. Then update your DNS configuration, and upload your HTTPS certificate.") for this option.
    
    With this option, Salesforce hosts your domain using your HTTPS certificate. If a third party hosts your domain, if you use a web application firewall (WAF), or if you use a third-party content delivery network (CDN), see [Use a Third-Party Service or CDN to Serve Your Custom Domain](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_external_host.htm&release=264.0.0&type=5 "Use a domain that’s hosted by a third-party service to serve your Experience Cloud sites or Salesforce Sites. These third-party services include third-party hosts, web application firewalls (WAFs), and non-Salesforce content delivery networks (CDNs).") instead.
2. From Setup, in the Quick Find box, enter Domains, and then select **Domains**.
3. Click **Add a Domain**.
4. Enter the domain name.
    
    Salesforce validates ownership based on the fully qualified domain name (FQDN) that you enter when you add a domain to your org. If you get an error message, [point your custom domain to your org](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_update_dns.htm&release=264.0.0&type=5 "Before you add a domain in Salesforce, point your domain to your Salesforce org in Domain Name Service (DNS). If your custom domain uses your HTTPS Certificate or the Salesforce content delivery network (CDN) partner, add a canonical domain name (CNAME) record for your fully qualified domain (FQDN) to DNS. The CNAME record references your Salesforce org ID and your FQDN. Then, if you plan to use the Salesforce CDN to serve your Experience Cloud site on your custom domain, add a second CNAME record that our CDN partner requires."), and then wait for the changes to propagate. After you update your domain’s DNS record, it can take up to 20 hours for that change to take effect worldwide.
5. For Domain Configuration Option, select **Serve the domain with your HTTPS certificate on Salesforce servers**.
6. Click the lookup icon (![The lookup icon](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/extend_click/images/lookup_icon.png)), and then select your certificate.
    
    Here’s the Domain page when you select the domain configuration option to serve the domain with your HTTPS certificate.
    
    ![Domain page when adding a custom domain that uses your HTTPS certificate.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/extend_click/images/domain_add_salesforce_cloud.png)
    
    The top of the page includes your 18-digit org ID and the format for the canonical name (CNAME) in DNS to point your domain to your org (1). To specify the certificate for this domain, use the certificate field (2). When you select the option to serve your domain with your HTTPS certificate on Salesforce servers, additional guidance includes the target host name to use for the CNAME record for your domain in DNS (3). Replace `[domain]` with your domain name, such as www.example.com.
7. If your domain is a registrable domain such as https://example.com, to avoid vulnerabilities during HTTP redirects, select **Allow HSTS preloading registration**.
    
    This setting adds the preload directive to the HSTS header. After you enable this setting, submit your domain at [https://hstspreload.org](https://hstspreload.org). For more information, including how to enable HSTS preloading for a domain with a subdomain, see [Enable HSTS Preloading on a Custom Domain](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_hsts_preloading.htm&release=264.0.0&type=5 "As a security best practice, enable and submit your custom domain for HTTP Strict Transport Security (HSTS) preloading. Connections can be vulnerable when HTTP requests are redirected to HTTPS. An example is a user attempting to access your custom domain using the HTTP protocol. By adding your registrable domain to the third-party HSTS preload list, supported browsers always use HTTPS, protecting your users from attacks during those HTTP redirections.").
8. For Associated Org, select the org from which you want this custom domain to serve site content.
    
    For example, to serve the sites in your production org, select **Production**. Or select a sandbox where you want to test this custom domain.
    
    This field only appears in production orgs with associated sandboxes. You can edit this field only from production orgs. For more information, see [Test Your Custom Domains in a Sandbox](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_sandbox_custom_domains.htm&release=264.0.0&type=5 "Develop and test your custom domains that serve content from your Experience Cloud sites and Salesforce Sites in a sandbox before you activate the domain in production.").
9. Save your domain.
    
    The status of your domain changes to Awaiting Custom URL. For domains with this domain configuration option, provisioning starts when you add the first custom URL.
10. To serve your sites via your domain, [add a custom URL](https://help.salesforce.com/s/articleView?id=platform.custom_url_add.htm&release=264.0.0&type=5 "To specify the site to load when users access your custom domain, add a custom URL. Optionally, you can define additional relationships between your domains and sites by mapping paths for your domain to your sites.").
    
    When you add the first custom URL for your domain, Salesforce provisions the domain or gets it ready to be used. The provisioning process can take 4–14 hours. When that process is complete, the domain’s status on the Domains Setup page changes to Awaiting Activation and you receive an email.
    
    Newly created custom domains use HTTP, not HTTPS, until you activate the domain.
11. To activate your domain, on the Domains Setup page, click **Activate** next to your custom domain name.
    
    Your site can be unavailable for 5–10 minutes, so activate your custom domain when your site traffic is low. When your site is active, the status changes from Awaiting Activation to Completed and the Current Domain Configuration Option changes to Salesforce Cloud.

This diagram shows the connectivity between your custom domain and your Experience Cloud site content after you set up a custom URL to serve your site and activate your custom domain. Dotted lines (![dotted line](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/extend_click/images/arrow_dotted.png)) represent DNS configurations, and the solid line (![solid line](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/extend_click/images/arrow_solid.png)) represents user traffic flow through HTTPS. The gray line represents traffic that originates outside Salesforce, and the blue lines represent traffic that originates in Salesforce. In this example, the domain name is www.example.com and the 18-digit org ID is 00d000000000000013.

![Connectivity diagram for custom domains that use your HTTPS certificate.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/extend_click/images/custom_domain_customer_cert.png)

In DNS, a CNAME record points your custom domain (1) to the Salesforce internal CNAME record for your org (2), which includes your org ID. In Salesforce, your certificate is stored on a secure server (3). Salesforce uses that certificate to serve the content from your Experience Cloud site (4).

#### See Also

- [Custom Domains](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt.htm&release=264.0.0&type=5 "Provide a branded experience for users who access your external-facing Salesforce content by serving your Digital Experiences or Salesforce Sites on a domain that you own, such as https://www.example.com.")
- [Prerequisites for a Custom Domain That Uses Your HTTPS Certificate](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_cert_prereqs.htm&release=264.0.0&type=5 "Before you serve your domain with an HTTPS certificate that you own, confirm that this domain configuration option applies to your configuration. Then update your DNS configuration, and upload your HTTPS certificate.")