I’ve tried to update one of our existing certificates in Salesforce by performing the following steps:

  1. Setup -> Certificate and Key Management
  2. Click the “wildcard.codefuel.com” certificate.
  3. Click the “Update Signed Certificate” button.
  4. Choose the certificate file from my computer and click “Save”. (certificate file enclosed)
  5. I get an error: The certificate that you are uploading doesn't match the generated certificate signing request.

I've tried to upload directly the new .crt file we've gotten from our CA. I haven't downloaded the .csr file from salesforce since this certificate is used by other systems too.

Any ideas how can I overcome this issue?


Salesforce REALLY wants CA-signed certs to be generated from the CSRs it provides, but that's not always possible. Here's how I solved it without a CSR, with help from this post: https://stackoverflow.com/questions/906402/how-to-import-an-existing-x-509-certificate-and-private-key-in-java-keystore-to/56666663#56666663

  1. I got a Sectigo cert through Dreamhost (which didn't let me provide my own CSR) which provided me with the cert, the intermediate cert, and the private key. I saved each of these to files.

  2. Fire up a terminal and combine the two certs: cat mycert.crt intermediate.crt > combined.pem

  3. Bundle the certs and private key in a PKCS12 file: openssl pkcs12 -export -in combined.pem -inkey private.key -out pkcs.p12 -name mysite The password should have 6 characters.

  4. Create the keystore: keytool -importkeystore -destkeystore keystore.jks -srckeystore pkcs.p12 -srcstoretype PKCS12 -alias mysite The password should have 6 characters.

  5. Import the keystore in Salesforce: Certificate and Key Management > Import From Keystore. Upload the keystore file and enter its password.

  6. You should see your cert in the list of certs. Update your domain to use your newly-added cert. Save it. After a few minutes, Activate your domain. Wait a few more minutes and you should see the updated cert when you navigate to the new domain.


  • Step 3 is needed because keytool doesn't know how to import the private key, so we import it from a keystore format that does.
  • The name and alias should not exist already in your Salesforce list of Certificates. I don't think there's a way to update an existing cert with the same alias or label. The updated cert will need a new name and you'll need to change the domain object to use the new cert.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.