Named credentials can now establish secure connections to servers whose certificates are signed by a private or internal CA (certificate authority). Previously, named credential callouts failed if the server certificate didn’t chain to a Salesforce-trusted root authority. Enterprises that manage their own certificate infrastructure can now use named credentials with those certificates.
Where: This change applies to Lightning Experience and Salesforce Classic (not available in all orgs) in Enterprise, Performance, Unlimited, and Developer editions.
Why: Enterprises in finance, payments, and other regulated industries often run their own public key infrastructure (PKI) and sign server certificates with a private CA. Those valid certificates were rejected at run time.
The TLS handshake happens before any app-level authentication. When a named credential makes a callout, if the endpoint's certificate doesn't chain to a root CA that Salesforce already trusts, the handshake fails and the request never goes out regardless of the OAuth token, API key, or other credential configured on the named credential. Now, after you upload the issuing root certificate, named credentials honor that trust store for all subsequent callouts to that endpoint.