Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a site which has a simple lead form. We want to use a custom domain name like as our url which we can use for marketing. I know we can register a custom domain and point the cname record to the site url. But is it possible for me to have a ssl certification on point to salesforce site page? Has any body come up with a solution for secure pages using custom domain like as an example? Buyan

share|improve this question
Here's the Idea: Private SSL url's for Sites – Peter Knolle Mar 24 '14 at 23:40
up vote 6 down vote accepted


The answer to this question has changed with the SU14 release. See Configure a Custom Domain for Your Community which provides instructions that primarily involve contacting SF Support and the caveats highlighted below.

  • To enable HTTPS custom domains for your organization: contact

  • To associate certificates with a domain: contact

From Setup, click Domain Management | Custom URLs. Before you switch the CNAME of your domain name to point to a new target name, ensure that the new target name exists in the DNS by using dig or nslookup. When you created your domain names affects the target of your CNAME:

  • Domain names that were added before Summer ‘13, typically need to have their CNAME adjusted to point to the fully qualified domain followed by instead of to the organization’s sub-domain. For example, if your pre-Summer ‘13 domain is, then the target of its CNAME will need to be instead of before HTTPS will work.
  • Domain names that were added in or before Summer ‘13, don’t have the 18-character organization ID in the CNAME target.
  • Domain names that were added in or after Summer ‘13, already point to the proper place for setting up HTTPS in a custom domain.
  • Domain names that were added in or after Winter ‘14, use a CNAME that points to the fully qualified domain followed by your organization’s 18-character ID and For example, if your domain name is and your 18-character organization ID is 00dxx0000001ggxeay, then the target of its CNAME will need to be

Original Answer

Bunyan, take a look at the Sites FAQ which says the following:

Q: Does it support HTTPS custom URLs (not URLs) with our own certificate?

A: Not at this time


Q: Can i specify my own SSL certificate if i use a CNAME to brand my URL

A: SSL certificates specify an IP address and at the current time we do not provide a feature to host SSL certificates for sites other than the default domain

From the above, unless something has changed, I'd conclude that at this time it's not possible to do what you desire.

share|improve this answer
Thanks for your quick confirmation on this. – buyan kumar Dec 10 '13 at 16:39
This is not correct - see Mark Pond's answer below about use of a DNS CNAME from a custom domain. – RichVel Oct 23 '14 at 8:47
I've updated my answer with a link to the SU14 Release Notes as provided by @ThomasTaylor which is a definitive document newer than the one I used as the basis for my original post; one that I consider a more reliable one to reference at this time. Thank you for bringing this to my attention. – crmprogdev Oct 25 '14 at 13:27

To the contrary of the linked documentation from @crmprogdev, as of at least August 2013 Salesforce does support this scenario.

SFDC Help: Adding a Domain

To associate certificates with a domain: Contact

A couple of key points:

  • You must use a CA-Signed certificate
  • You must use a CSR generated by Salesforce
  • The certificate must be 2048 bits in length


Answers to the questions below

How do I associate our domain which managed by our infrastructure team to salesforce domain?

This is done using your DNS A or CNAME records. Salesforce can provide direction on how the DNS records should be configured.

Are you telling me that if we have a CA signed certificate for our domain, we can easily upload this to salesforce and have site pages display with a custom SSL url like https:/// as an example?

A URL like this one: https:/// could be handled with the Site.UrlRewriter interface but if you don't want to implement a UrlRewriter, your page URLs will take on the normal VF path of https:/// (where you have a VF page named contact).

Salesforce provides tools for managing certificates within your org. You would use these tools to generate a Certificate Signing Request (CSR) and have that request signed by the CA and then you can upload the certificate into your org.

Can you please explain how this would help to display custom domains with https on sites please?

Per that help document, you can contact Salesforce and they can associate your site with the SSL certificate which you uploaded. After that is complete, your site will be available using your SSL certificate via your custom web address defined on your site.

share|improve this answer
I believe the issue is that forms of that type get processed through and aren't always seen as going through the registered Domain. I agree that support for certificates has definitely been available for quite some time. As I understand it, it just "falls down" in certain situations. I also noted that things may have changed since the WIKI was published. I hope they have! ;) – crmprogdev Dec 10 '13 at 17:54
Domain Management was a Summer '13 feature - so this ability was likely added at that point. This ability to add a custom SSL certificate to a domain required herculean string-pulling prior to Summer '13 but this is in the docs and should work as described. – Mark Pond Dec 10 '13 at 18:11
@MarkPond Hi Mark , Thanks for your reply. Couple of questions. 1. How do I associate our domain which managed by our infrastructure team to salesforce domain? 2. Are you telling me that is we have a CA signed certificate for our domain, we can easily upload this to salesforce and have site pages display with a custom ssl url like https:/// as an example? 3. Can you please explain how this would help to display custom domains with https on sites please? Buyan – buyan kumar Dec 11 '13 at 19:24
I just came across a post on the Salesforce success site about this - from Joe Morse of Salesforce "This was true for a very limited pilot that ran until late last year (2013), but the product team is evaluating ways to make this work in production for (Safe Harbor) later this year. " – Bob Buzzard Jan 31 '14 at 8:49
There is a post-SU14 update that re-releases this feature. The primary audience/use case is Communities, but I have successfully gotten it working with sites for my company's secure donation forms product. – Thomas Taylor Aug 14 '14 at 17:11

Private SSL certs don't work. We've been on the road once - did everything as instructed by document: get CSR from SF, cert signed by a CA, uploaded the cert. In the end, it didn't do a thing for the site intended (with the cert URL configured as primary btw and CNAME rediret set up). After a 3 1/2 months case, SF finally said, "nope, feature wouldn't be production available until at least Winter '14". The exact quote from the case owenr was

I just had word with the PM for this feature. They mentioned that the this pilot feature is in hold. They are shooting for the Winter release (safe harbor) to go on a GA ( generally available feature). When this feature becomes public your org will be able to hold the valid SSL certificates for the sites.

Now Spring '14 is almost out, and the feature is still nowhere to be found.

share|improve this answer
Feature was re-released in a post-SU14 patch:… – Thomas Taylor Aug 14 '14 at 17:31

For completeness sake...

create an AWS account and run ngnix in a reverse proxy configuration. Setup your certificate and domain against that IP address and you can then forward website requests to salesforce using SSL and your own domain. It goes against the no hardware stance but since salesforce is a multi-tenant environment and SSL essentially requires a single IP/server per certificate they are going to be hard-pressed to support a large number of SSL custom domains as a general feature.

share|improve this answer
If going with AWS, what do you think about using CloudFront? It supports all HTTP verbs... – bigassforce Mar 24 '14 at 23:40
cloudfront is for putting static content closer to users. I should clarify the above statement to say, "create an AWS EC2 account". You need a host the reverse proxy. you could possibly put cloudfront in front of EC2 but it doesn't seem necessary. – ebt Mar 26 '14 at 20:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.