---
schema_version: "1"
id: e21d22a2ddf79ba9ca602562b42e3a32dedb08c3d63d10d49b8ff6af7762bfb2
title: Update an Expiring Certificate for Your Custom Domain
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/domain_mgmt_cert_update.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_cert_update.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 1e420cdeda3134038ac55021bf287951a6c4ddc55984adc0d999c51da3d5853c
description: If you serve your domain with your HTTPS certificate on Salesforce servers, avoid disruption to your domain by renewing or replacing your certificate before it expires. You can find the expiration date for your HTTPS certificates on the Certificate and Key Management Setup page. Also, admins receive an expiring certificate notification email before the certificate expires.
products:
  - Salesforce Platform
  - Security
release: "264"
---
# Update an Expiring Certificate for Your Custom Domain

If you serve your domain with your HTTPS certificate on Salesforce servers, avoid disruption to your domain by renewing or replacing your certificate before it expires. You can find the expiration date for your HTTPS certificates on the Certificate and Key Management Setup page. Also, admins receive an expiring certificate notification email before the certificate expires.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>Enterprise</strong>, <strong>Performance</strong>, and <strong>Unlimited</strong> Editions.</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Applies to: Salesforce Sites and <a href="https://help.salesforce.com/s/articleView?id=experience.exp_cloud_basics_glossary.htm&amp;language=en_US" target="_blank">LWR, Aura, and Visualforce sites</a></td></tr></tbody></table>

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d65348e78">User
              Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d65348e78 ">To create, edit, and manage certificates:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d65348e78 ">Customize Application</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d65348e78 ">To edit a domain:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d65348e78 ">Manage Custom Domains</td>

          </tr>
        </tbody>
      </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/images/icon_note.png)

Note These instructions apply only to certificates for custom domains that you serve with your HTTPS certificate on Salesforce servers. If your custom domain uses the Salesforce content delivery network (CDN) to serve your Digital Experiences, our CDN partner automatically renews the certificate. If a third-party service or CDN serves your domain, work with that third party to make sure that your certificates remain valid.

Unfamiliar with terms like DNS and certificate? See [Custom Domain Terminology](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_terms.htm&release=264.0.0&type=5 "Review the terms related to setting up a custom domain in Salesforce.").

By default, when you generate a certificate authority (CA)-signed HTTPS certificate in Salesforce, that certificate expires in a year, after which the certificate isn’t trusted. If you serve your site with a certificate that you uploaded to your Experience Cloud site, that certificate also expires periodically. To avoid downtime and allow time for testing, update your certificate at least one week before the certificate expires.

1. Download your existing certificate.
    
    It’s a good idea to save a copy of any key before you delete it. If there’s an issue after you delete a certificate, you can import the key later.
    
    1. From Setup, in the Quick Find box, enter Certificate and Key Management, and then select **Certificate and Key Management**.
    2. In the Label column, select the certificate to download.
    3. On the Certificate and Key Detail page, select Download Certificate.
    4. Save the \*.crt file to a safe location.
2. Create and upload a new certificate to Salesforce.
    
    Although it’s technically possible to update your existing certificate, we recommend that you create a certificate in Salesforce when your certificate is about to expire. This approach increases the security of your certificate because adding a certificate generates a new public-private key pair for encryption
    
    1. If your CA uses intermediate certificates, see the instructions in the knowledge article, [Merge a complete certificate chain for custom HTTPS domains](https://help.salesforce.com/s/articleView?id=000386535&type=1&language=en_US).
    2. To upload your certificate to Salesforce, see [Generate a Certificate Signed by a Certificate Authority](https://help.salesforce.com/s/articleView?id=security_keys_uploading_signed_cert.htm&language=en_US). You can get the required CA signature as a part of that process.
    3. To import an existing certificate that is already signed, see the knowledge article, [Use HTTPS certificate that exists within your Community domain](https://help.salesforce.com/s/articleView?id=000387916&type=1&language=en_US).
3. To use the new certificate, update your custom domain.
    
    1. From Setup, in the Quick Find box, enter Domains, and then select **Domains**.
    2. Next to your domain, select **Edit**.
    3. Under the domain configuration option, serve the domain with your HTTPS certificate on Salesforce servers, and clear the certificate field. Then select the lookup icon (![The lookup icon](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/extend_click/images/lookup_icon.png)).
        
        ![Domain Edit screen with the certificate field circled.](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-platform-extend_click-264-0-0-production-enus/5f7d9219-b7b1-4552-8891-f1aba9b289fc/extend_click/images/domain_edit_cert.png)
    4. In the lookup window, select the label of the new certificate.
    5. Save your changes.
    
    It can take up to 4 hours for the updated certificate to take effect.
4. Validate your domain.
    
    Because it can take up to 4 hours for the change to take effect, we recommend that you validate your domain both after you save your changes and then again the next day.
5. Optionally, delete your old certificate.
    1. From Setup, in the Quick Find box, enter Certificate and Key Management, and then select **Certificate and Key Management**.
    2. For the expired certificate, select **Del**.
        
        This option is available only when no domain, identity provider, single sign-on (SSO) setting, or connected app uses the certificate.

#### See Also

- [Custom Domains](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt.htm&release=264.0.0&type=5 "Provide a branded experience for users who access your external-facing Salesforce content by serving your Digital Experiences or Salesforce Sites on a domain that you own, such as https://www.example.com.")
- [Custom Domain Management](https://help.salesforce.com/s/articleView?id=platform.domain_mgmt_dom_detail.htm&release=264.0.0&type=5 "Keep your custom domain up to date with your business needs. Learn how to manage your domain during org migrations and certificate changes. Edit your domain’s configuration option, move to a different domain name, or enable HSTS preloading. And when you no longer need a custom domain, delete the domain and its custom URLs in Salesforce.")
- [Certificates and Keys](https://help.salesforce.com/s/articleView?id=xcloud.security_keys_about.htm&type=5&language=en_US)