1

Recently we received a "SFDC Expiring Certificate Notification" notification: "You have one or more certificates in your Salesforce org XYZ that will expire soon."

We could not remember ever having created such a thing, but who knows, we did lots of things at the start of the project. It turns out that this certificate was created indeed at the start of the project and that it is used in an identity provider (which we didn't know we had). After some googling, I found Domain Name Overview that states: "Salesforce is automatically enabled as an identity provider when a domain is created"

The article does not explain whether the created identity provider is really needed for a domain. Can we just disable the identity provider and delete the certificate? Or will users then no longer be able to log in?

And if not, why doesn't Salesforce auto-generate a new certificate and use that in the identity provider?

  • Are you referring to this point "Access increased support for single sign-on. My Domain is required to use some Salesforce Identity features, such as authentication providers and identity providers." ? – Salesforcesmarty Feb 1 '16 at 12:14
  • No, we created a domain primarily to have a custom picture in the login screen. Now we understand that as a side effect, Salesforce creates both an identity provider and a certificate. Question: do we need those two for the domain or can we simply disable and delete them? We don't do any fancy custom login stuff, just a domain with an altered login picture. – Sander de Jong Feb 1 '16 at 12:20
  • Even I am not 100% sure about this. Let me try this in some dev org and I will get back to you. – Salesforcesmarty Feb 1 '16 at 12:26
2

Finally I figured it out.

Looks like the identity provider and the certificate are used for other services. If you try to login to your org from any third party service provide, salesforce will behave as Identity provider for this custom domain URL.

In simple words, you can disable the Identity Provider and your domain login will still work.

Hope this helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.