2

I've been following this article from Salesforce on how to setup a custom domain for serving up a Salesforce community. On step 2 it says I have to setup a certificate for use with the domain.

My goal is to have a community like:

https://support.mydomain.com

We already have a wildcard certificate for our domain, but the the instructions in the article make it appear like I cannot use my existing one and I have to create a new one instead.

Do I have to buy a new certificate just for Salesforce or is there some way of using my existing wildcard certificate?

Improve this question

3 Answers 3

Reset to default
3

You can do it: Custom Domains: Using an Existing HTTPS Certificate With Your Community https://help.salesforce.com/articleView?id=000232390&type=1

It is possible to request a new HTTPS certificate or to reuse certain existing certificates in your community domain. Broadly, there are two options:

  1. New certificate: If your community will need a new HTTPS certificate, you can follow the instructions in Help & Training to configure & download a new Certificate Signing Request to give to your certificate authority.

  2. Using existing certificate for my community domain: If your company already has a certificate that matches the domain your community will run under, you can take the steps detailed in the link to import that certificate into a Java keystore (JKS) file to prepare it for upload to your org.

Improve this answer
1
  • When posting a link please also include a short synopsis of what is on the link as links often break. See How to Answer
    – Dave Humm
    Commented Nov 30, 2017 at 9:13
2

As it turns out, Salesforce does not allow you to import an existing, signed certificate. You have to go through the process of generating a new Certificate Signing Request, uploading that to your SSL provider, then uploading a new signed certificate.

In my case, that meant buying a new certificate, even though I have an existing wildcard certificate.

Improve this answer
2
  • 1
    Yes, it is a pain having to get a new CSR and getting the new signed one from the provider, but it needs the information that SF embed in the signing request.
    – Dave Humm
    Commented Nov 30, 2017 at 9:11
  • I was able to import a certificate without doing a CSR; please see my answer
    – Jason Hartfield
    Commented Nov 2, 2021 at 13:43
0

I was able to import a wildcard certificate to Salesforce from GoDaddy that is used across multiple sites and ORGs. They 'trick' is to create a JKS file from the private key and certificate and upload that. That JKS can be reused in multiple ORGs. On a Mac I took the following steps:

  1. Move your private key file and crt file to the same directory
  2. Open a terminal window in that directory
  3. Run openssl pkcs12 -export -in mycertificate.crt -inkey generated-private-key.txt -certfile mycertificate.crt -name "Wildcard Certificate" -out mykeystore.p12 (generated-private-key.txt is your key file and mycertificate.crt is the signed certificate)
  4. Run keytool -importkeystore -srckeystore mykeystore.p12 -srcstoretype pkcs12 -destkeystore keystore.jks -deststoretype JKS

The resulting 'keystore.jks' file can then be imported to the Certificates area of Setup in Salesforce.

I did run into one "gotcha": the private key GoDaddy supplied was in a "UTF-8 with BOM" format. I was able open the file in Visual Studio Code and save it as a UTF-8 file.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .