---
schema_version: "1"
id: 30464b0b82b10f837a3b8420d95550b36a92ecd6dff47b774d31fed47edb7b3a
title: eCDN Automatic Certificates
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/commerce-api/guides/cdn-zones-automatic-certs.md
canonical_url: https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/cdn-zones-automatic-certs.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: a0c3f45942ca1ad76144993dacf99af3ccc0a2037aa204a8e22755564a9c6ba8
products:
  - Composable Storefront
  - Salesforce APIs
---
# eCDN Automatic Certificates

Use eCDN automated certificates to serve storefront traffic over HTTPS without the hassle of managing certificates.

This guide covers how to enable it on new and existing hostnames as well as legacy eCDN zones using the CDN Zones API.

**note:** **You can also manage automated certificates in Business Manager.** _For more information, see [Add Managed SSL Certificates](https://help.salesforce.com/s/articleView?id=cc.b2c_add_managed_ssl_certificates.htm&type=5)_.

## Prerequisites

1. Familiarize yourself with [Authorization for SCAPI Admin APIs](https://developer.salesforce.com/docs/commerce/commerce-api/guide/authorization-for-admin-apis.html)
2. You must have an Account Manager API Client with the scope `sfcc.cdn-zones.rw`.
3. You must have an existing proxy zone associated with the hostname you'd like to use.
4. You must have a proxy zone. Automatic certificates are not supported by legacy zones. If you have a legacy zone, first [migrate to a proxy zone](#migrate-from-legacy-zones-to-proxy-zones-to-use-automatic-certificates).
5. You must know the zone ID of the proxy zone to be used with automatic certificates. To get this info, use [getZonesInfo](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=getZonesInfo).

## Enable Automatic Certificates on an Existing Hostname

To use an automated certificate with an existing hostname that is associated with a custom certificate, lookup its certificate ID with [getCertificates](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=getCertificates). Next, call [updateCertificate](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=updateCertificate):

```bash
curl "https://$CODE.api.commercecloud.salesforce.com/cdn/zones/v1/organizations/$ORG/zones/$ZONE/certificates/$CERTIFICATE" \
  --request 'PATCH' \
  --header "Authorization: Bearer $TOKEN" \
  --header 'Content-Type: application/json' \
  --data '{
    "hostname": "www.example.com",
    "certificateType": "automatic",
    "certificateAuthority": "lets_encrypt"
  }'
```

This call replaces the existing custom certificate with an automated certificate without downtime.

Let's review the data provided in the request body.

The value of `hostname` is the domain you'd like to use with the automated certificate. `certificateType` must be set to `automatic`. Finally, `certificateAuthority` controls which certificate authority is used to issue the certificate. The value must be either `lets_encrypt` or `google`. The choice of providers is up to you.

## Enable Automatic Certificates on a New Hostname

To use an automated certificate with a new hostname, follow the instructions to [configure eCDN](https://help.salesforce.com/s/articleView?id=cc.b2c_configure_the_embedded_cdn.htm&type=5). Rather than adding a certificate through Business Manager, call [addCertificateForZone](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=addCertificateForZone):

```bash
curl "https://$CODE.api.commercecloud.salesforce.com/cdn/zones/v1/organizations/$ORG/zones/$ZONE/certificates" \
  --header "Authorization: Bearer $TOKEN" \
  --header 'Content-Type: application/json' \
  --data '{
    "hostname": "www.example.com",
    "certificateType": "automatic",
    "certificateAuthority": "lets_encrypt"
  }'
```

## Migrate from Legacy Zones to Proxy Zones to Use Automatic Certificates

Automatic certificates are not available for legacy zones.

**note:** A zone is a legacy zone if it does not end in `cc-ecdn.net`.

For more information on proxy and legacy zones, review [this article](https://help.salesforce.com/s/articleView?id=cc.b2c_ecdn_proxy_zone_faq.htm&type=5).

To use automatic certificates, you must first migrate to proxy zones.

To migrate to a proxy zone:

1. Create the storefront zones with [createStorefrontZone](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=createStorefrontZone).
2. Copy required settings from your legacy zones to the proxy zones.
3. Request an automatic certificate with [addCertificateForZone](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=addCertificateForZone).
4. Perform a DNS cutover by updating your storefront's DNS records.

First, create your storefront zone:

```bash
curl "https://$CODE.api.commercecloud.salesforce.com/cdn/zones/v1/organizations/$ORG/storefront-zones" \
  --header "Authorization: Bearer $TOKEN" \
  --header 'Content-Type: application/json' \
  --data '{
    "domainName": "example.com"
  }'
```

**note:** You must create the storefront zone for both your `prd` and `dev` organization IDs to continue to manage your zones in Business Manager.

Second, copy any required settings from your legacy zones using [createFirewallRule](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=createFirewallRule), [updateSpeedSettings](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=updateSpeedSettings) and [updateSecuritySettings](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=updateSecuritySettings).

Third, request an automatic certificate with [addCertificateForZone](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=addCertificateForZone):

```bash
curl "https://$CODE.api.commercecloud.salesforce.com/cdn/zones/v1/organizations/$ORG/zones/$ZONE/certificates" \
  --header "Authorization: Bearer $TOKEN" \
  --header 'Content-Type: application/json' \
  --data '{
    "hostname": "www.example.com",
    "certificateType": "automatic",
    "certificateAuthority": "lets_encrypt"
  }'
```

Finally, perform a DNS cutover by updating your storefront's DNS records. Get the DNS CNAME record value from [getZonesInfo](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=getZonesInfo)'s `name` property.

```txt
www.example.com    CNAME    commcloud.prod-abcd-example-com.cc-ecdn.net.
```

## Advanced Topics

Refer to the following sections for additional use case information.

### Revert to Custom Certificates

You can update an automatic certificate to a custom certificate using [updateCertificate](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=updateCertificate).

### CDN Stacking

In a stacking configuration, certificate renewals require validation, just as when certificates are initially requested. When traffic is flowing through eCDN, validation is done using HTTP by serving records from the eCDN edge automatically without any user intervention.

In a stacking scenario where regular store traffic flows through the stacked config, some stacked service configurations don’t pass the validation records along correctly. In such a scenario, the initial validation method doesn’t matter. Salesforce doesn’t have control of your DNS and can’t automatically place a new TXT record. The only means of automated validation is through HTTP validation.

For HTTP validation to complete, eCDN must serve a validation value for a URI matching this pattern:

```text
http://<hostname>/.well-known/acme-challenge/<random-validation-key>
```

**tip:** This check is completed over HTTP, not HTTPS. Confirm the URI is available over HTTP.
**note:** When using eCDN-managed certificates with a third-party CDN stacked on top, opting for TXT record validation is required every three months due to the certificate's automatic renewal cycle. Without domain control validation (DCV) delegation, TXT record updates are required every 2–3 months. DCV delegation automates the TXT verification process and is helpful if you're experiencing issues with HTTP validation. If needed, contact support for a DCV delegation UUID to include in your DNS record.
If you use certificate pinning, using automatic certificates is not possible as the certificate may be updated at any time.

### Validation Methods

There are two choices of validation for automated certificates: HTTP and DNS.

HTTP validation is used by default is the right choice in most cases.

Where a short issue delay is not acceptable, use DNS validation by providing the `certificateValidation` request property with a value of `txt`:

```bash
curl "https://$CODE.api.commercecloud.salesforce.com/cdn/zones/v1/organizations/$ORG/zones/$ZONE/certificates" \
  --header "Authorization: Bearer $TOKEN" \
  --header 'Content-Type: application/json' \
  --data '{
    "hostname": "www.example.com",
    "certificateType": "automatic",
    "certificateAuthority": "lets_encrypt",
    "certificateValidation": "txt"
  }'
```

Use [getCertificates](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=getCertificates)'s `customHostnameVerificationTXTName` and `customHostnameVerificationTXTValue` response properties to create your validation DNS TXT record.

You can change a certificate's validation type using [updateCertificate](https://developer.salesforce.com/docs/commerce/commerce-api/references/zones?meta=updateCertificate).

## Constraints

- Automated certificates are only available for proxy zones.
- You can request up to five hundred automated certificates per zone.
- Automated certificates are only available from Let's Encrypt and Google certificate authorities. To use a different certificate authority or a certificate with extended validation, use custom certificates.