---
schema_version: "1"
id: 8d942b3de2ae558980889b4a58e01d3e06344dcf48e3aaf264c45e00172620cc
title: Expand Integrations with Named Credentials Support for Custom CA Certificates
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/264-0-0/rn_security_named_credentials_custom_certs.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_named_credentials_custom_certs.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 6abd7d364f8b54247e6aa99ad7306be0873319124482ce72af1eb617574fcb5c
description: Named credentials can now establish secure connections to servers whose certificates are signed by a private or internal CA (certificate authority). Previously, named credential callouts failed if the server certificate didn’t chain to a Salesforce-trusted root authority. Enterprises that manage their own certificate infrastructure can now use named credentials with those certificates.
products:
  - Cross Cloud
release: "264"
---
# Expand Integrations with Named Credentials Support for Custom CA Certificates

Named credentials can now establish secure connections to servers whose certificates are signed by a private or internal CA (certificate authority). Previously, named credential callouts failed if the server certificate didn’t chain to a Salesforce-trusted root authority. Enterprises that manage their own certificate infrastructure can now use named credentials with those certificates.

**Where:** This change applies to Lightning Experience and Salesforce Classic (not available in all orgs) in Enterprise, Performance, Unlimited, and Developer editions.

**Why:** Enterprises in finance, payments, and other regulated industries often run their own public key infrastructure (PKI) and sign server certificates with a private CA. Those valid certificates were rejected at run time.

The TLS handshake happens before any app-level authentication. When a named credential makes a callout, if the endpoint's certificate doesn't chain to a root CA that Salesforce already trusts, the handshake fails and the request never goes out regardless of the OAuth token, API key, or other credential configured on the named credential. Now, after you upload the issuing root certificate, named credentials honor that trust store for all subsequent callouts to that endpoint.

#### See Also

- [_Salesforce Help:_ Manage Your Certificate Trust Store](https://help.salesforce.com/s/articleView?id=xcloud.security_keys_trust_store_manage.htm&type=5&language=en_US)