I've been following this article from Salesforce on how to setup a custom domain for serving up a Salesforce community. On step 2 it says I have to setup a certificate for use with the domain.

My goal is to have a community like:


We already have a wildcard certificate for our domain, but the the instructions in the article make it appear like I cannot use my existing one and I have to create a new one instead.

Do I have to buy a new certificate just for Salesforce or is there some way of using my existing wildcard certificate?

3 Answers 3


You can do it: Custom Domains: Using an Existing HTTPS Certificate With Your Community https://help.salesforce.com/articleView?id=000232390&type=1

It is possible to request a new HTTPS certificate or to reuse certain existing certificates in your community domain. Broadly, there are two options:

  1. New certificate: If your community will need a new HTTPS certificate, you can follow the instructions in Help & Training to configure & download a new Certificate Signing Request to give to your certificate authority.

  2. Using existing certificate for my community domain: If your company already has a certificate that matches the domain your community will run under, you can take the steps detailed in the link to import that certificate into a Java keystore (JKS) file to prepare it for upload to your org.

  • When posting a link please also include a short synopsis of what is on the link as links often break. See How to Answer
    – Dave Humm
    Nov 30, 2017 at 9:13

As it turns out, Salesforce does not allow you to import an existing, signed certificate. You have to go through the process of generating a new Certificate Signing Request, uploading that to your SSL provider, then uploading a new signed certificate.

In my case, that meant buying a new certificate, even though I have an existing wildcard certificate.

  • 1
    Yes, it is a pain having to get a new CSR and getting the new signed one from the provider, but it needs the information that SF embed in the signing request.
    – Dave Humm
    Nov 30, 2017 at 9:11
  • I was able to import a certificate without doing a CSR; please see my answer Nov 2, 2021 at 13:43

I was able to import a wildcard certificate to Salesforce from GoDaddy that is used across multiple sites and ORGs. They 'trick' is to create a JKS file from the private key and certificate and upload that. That JKS can be reused in multiple ORGs. On a Mac I took the following steps:

  1. Move your private key file and crt file to the same directory
  2. Open a terminal window in that directory
  3. Run openssl pkcs12 -export -in mycertificate.crt -inkey generated-private-key.txt -certfile mycertificate.crt -name "Wildcard Certificate" -out mykeystore.p12 (generated-private-key.txt is your key file and mycertificate.crt is the signed certificate)
  4. Run keytool -importkeystore -srckeystore mykeystore.p12 -srcstoretype pkcs12 -destkeystore keystore.jks -deststoretype JKS

The resulting 'keystore.jks' file can then be imported to the Certificates area of Setup in Salesforce.

I did run into one "gotcha": the private key GoDaddy supplied was in a "UTF-8 with BOM" format. I was able open the file in Visual Studio Code and save it as a UTF-8 file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.