I generated a CSR from Salesforce setup and have received back the PositiveSSL Certificate from sectigo.com.

But when I try and upload the certificate into Salesforce, I get this error:

Error: The certificate that you are uploading doesn't match the generated certificate signing request.

Included with the SSL certificate were these additional files:

  • Root CA Certificate - AddTrustExternalCARoot.crt
  • Intermediate CA Certificate - USERTrustRSAAddTrustCA.crt
  • Intermediate CA Certificate - SectigoRSADomainValidationSecureServerCA.crt
  • Your PositiveSSL Certificate - mycert.crt

I tried combining a couple of the certificates:

cat mycert.crt AddTrustExternalCARoot.crt > combined.pem


cat mycert.crt SectigoRSADomainValidationSecureServerCA.crt > combined.pem

and uploading the combined.pem but I got the same error.


  1. Why won't Salesforce accept the SSL certificate?
  2. What do I need to do to get Salesforce to accept the cert?

NOTE: I've raised a support ticket and it got immediately got closed because the org does not have developer support.


In a certificate chain, you have to include all certificates starting from the domain and up towards the root. This should work:

cat mycert.crt SectigoRSADomainValidationSecureServerCA.crt USERTrustRSAAddTrustCA.crt > combined.pem

The position of the certs in the chain is based on Sectigo docs:

Domain Validation:

  • USERTrust RSA Certification Authority [ Root Certificate Cross Signed ]
  • Sectigo RSA Domain Validation Secure Server CA [ Intermediate ]
  • Thanks, but unfortunately I get the same error Error: The certificate that you are uploading doesn't match the generated certificate signing request.
    – Robs
    Nov 5 '19 at 15:25
  • 1
    You can try cat mycert.crt SectigoRSADomainValidationSecureServerCA.crt USERTrustRSAAddTrustCA.crt AddTrustExternalCARoot.crt > combined.pem as your chain. If that doesn't work, best option is to validate your cert with OpenSSL. When you find a chain that works in OpenSSL, the same chain of certs should work with Salesforce...assuming your certificate signing request does actually match one that was used by Sectigo to sign the cert.
    – identigral
    Nov 5 '19 at 15:32
  • Thanks, I ran this command openssl verify -CAfile AddTrustExternalCARoot.crt -untrusted SectigoRSADomainValidationSecureServerCA.crt USERTrustRSAAddTrustCA.crt and got this output USERTrustRSAAddTrustCA.crt: OK ... what next?
    – Robs
    Nov 5 '19 at 15:43
  • 1
    Try these two commands openssl verify -CAfile USERTrustRSAAddTrustCA.crt -untrusted SectigoRSADomainValidationSecureServerCA.crt mycert.crt or openssl verify -CAfile AddTrustExternalCARoot.crt -untrusted USERTrustRSAAddTrustCA.crt SectigoRSADomainValidationSecureServerCA.crt mycert.crt and see if one of these two works.
    – identigral
    Nov 5 '19 at 15:55
  • 1
    If OpenSSL fails to verify, the intermediate and/or root certs in this chain are not the right ones. I would suggest following up with Sectigo first and get them to help you identify the right root and intermediate certs.
    – identigral
    Nov 5 '19 at 16:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.