We're configuring a custom domain for a Community (Digital Experience). When creating a new Domain in Salesforce, we have the choices between:
- Salesforce serves the domain over HTTPS, on Salesforce's servers, using your HTTPS certificate
- Salesforce serves the domain over HTTPS using a Salesforce content delivery network (CDN) partner and a shared or single HTTPS certificate
- A non-Salesforce host or service serves this domain over HTTPS
- Temporary non-HTTPS domain
The question is how to determine which option to use. I'm especially puzzled between the first and the second. In the past we have done this using option 1 with the CA signed SSL certificate, which works well but is quite a hassle, and needs the yearly certificate update. I see that the second option is available since Winter '19. What are the reasons not to go for this option, given that it's less pain to set up? Is it a safe choice for a community (behind a login)?