What can be done with SSL + Communities + Force.com Site + Branded Domain

Question

I'm getting mixed messages online regarding SSL support for a Force.com site that is branded with a custom URL domain:

• These two articles, Registering a Custom Force.com Domina and Registering a Custom Domain for Your Force.com Site, seem to suggest that you can register a force.com domain, mycompany.secure.force.com as a CNAME record for a branded domain, www.mycompany.com.
• On the other hand this idea, Private SSL url's for Force.com Sites, suggests HTTPS is not supported yet.

Assuming SF cannot support HTTPS yet, what can be done to brand the URL, if at all possible?

Answer 1

UPDATE April 2021 - even though this is the accepted answer, and I wrote it, it's no longer correct, so you shouldn't read it. Custom domains over SSL are now fully supported, although there are a few hoops to jump through - see my new answer below for more info

You can't do anything to brand the URL for an SSL site - there was a pilot last year allowing this, but that has stopped and as far as I'm aware, none of the functionality has been opened up as generally available. It may be possible if you are a large marquee customer - Activision have this for https://support.activision.com/ (if you inspect the source you'll see a Visualforce viewstate in there). Joe Morse of Salesforce had the following to say on the success site:

> "This was true for a very limited pilot that ran until late last year > (2013), but the product team is evaluating ways to make this work in > production for (Safe Harbor) later this year. " The best I've been able to do is have a thin page or pages hosted by another server that supports the domain name, and then iframe in the https site. That way the force.com URL that is serving the actual content is masked by the thin page wrapper. It can get unwieldy if you are relying on deep linking and bookmarks though, as you then need to be refreshing the outer page each time you navigate to another site page, so you need to orchestrate some navigation using JavaScript.

If you are interested in some of the technical details as to why custom domain names over SSL might be tricky for Salesforce, check out this question and answers:

Sites/Portals and SSL

Answer 2

A recent (post-Summer 14) update now allows vanity domains for Communities.

http://docs.releasenotes.salesforce.com/en-us/api/release-notes/communities_custom_domain_URL.htm

Check out the Success Community for more information.

https://success.salesforce.com/_ui/core/chatter/groups/GroupProfilePage?g=0F9300000001oDd&fId=0D53000001ZBmbJ&emtm=1407655656055&s1nid=0DB30000000072L&fromEmail=1&emkind=chatterGroupDigest&s1ext=0&s1oid=00D300000000iTz&s1uid=0053000000A8HTN

Answer 3

A few weeks ago I had the same discussion with the salesforce support team. I tried to associate a domain and custom (CA) certificate.

This seems to be a documented feature:

To associate certificates with a domain: Contact salesforce.com - Salesforce docu - domains

Therefore I created a domain and contacted salesforce. But they told me that there is no way to associate domains and certificates in Salesforce.com. In my business case I implemented shop system based on force.com sites. SSL was a key feature for me.

But anyway long story short: They told me that the activision case was a very limited pilot. (And from my point of view it was limited to activition.. ;-) )

In the end the support told me that this feature would be or could be part of the roadmap and I should wait...

But from my point of view there is a workaround:

Cloudflare allows you (paid version) to implement "SSL Proxies". Using this feature you can use the custom or branded domain e.g. yourCompany.secure.force.com and in the background you can use cloudflare to send all the traffic via ssl to cloudflare and they will forward it for you to salesforce.

Cloudflare wrote an article about this topic some years ago (in particular they are talking about google app engine but basically it is the same issue). Blog Article

Answer 4

This is now fully supported by Salesforce, and with the Summer 21 release is mandatory, as Sites and Communities will no longer support HTTP.

Once you've chosen your custom domain, there's an excellent write up about securing with SSL at : https://medium.com/cloudanswers/add-ssl-for-free-on-force-com-sites-b88cb57d3d64 - I've been using these instructions for a while for my toolbox example site (https://toolbox.bobbuzzard.org). One word of advice - you can't upload renewals to Salesforce, instead you have to go through the whole certificate signing request each time. The post also picks up that you have to combine your cert and the certifying authority bundle - make sure to do that, otherwise you can waste a lot of time.

Note also that you have to prove ownership of the domain in order to request an SSL cert - I typically use the option to set up a new CNAME record to ZeroSSL's requirements - typically takes about 10 minutes to come through.