2

I am getting, by mail, the following notification:

Sandbox: SFDC Expiring Certificate Notification

You have one or more certificates in your Salesforce org xxxxxxxxx 00Dxxxxxxxxxxxx that will expire soon. Review the list below and visit Certificate and Key Management from Setup to make an update.

. SelfSignedCert_16Aug2021_131939, Self-Signed, expires on 8/16/2022. Warning: This certificate will expire in 10 day(s).

Only, the list of certificates in my org is empty; also, I do not remember ever to have created such a certificate.

Can anyone explain?

2
  • 1
    Are you sure you are checking the right org? Aug 8, 2022 at 11:34
  • 1
    it turns out I was looking at the wrong org - Sorry for the bother
    – willeg
    Aug 15, 2022 at 19:23

2 Answers 2

4

As you mentioned that the list of certificates in your org is empty, it is because you are checking a different org than what is mentioned in the automated email received.


Additional info adding to sfdcfox's answer:

The reason you have received the email was that, if any certificate was to expire in the upcoming days/months, Salesforce has an inbuilt functionality that sends certificate expiry notifications at 60-day mark, 30-day mark,10-day mark, and day of expiry.

You should be able to see the delete option for the expired certificates in your org. Usually, the Delete button will be grayed out if certificate is in use somewhere. You'll have to remove its usage before for being able to see the delete button.

Similar post from the past: Do I need to renew the default SelfSignedCert that I never created?

Recommended checks to identify if the expired certificate is being used:

1.Single Sign-On settings -Check your Single sign-on setting(from the setup menu) and see that you are not using the certificate over there.

2.Identity Provider Settings - If you are using this certificate, logs would be generated in the "Identity Provider Event Log"

3.Connected app - Open the connected app and see if the certificate is provided as any IDP certificate

4.Web service callout - You need to find out if you are using this certificate within your Integration as a client certificate; if yes, then you need to share this updated certificate with your Server(3rd party integration) team so that they can replace the old certificate with the new one. Your Integration team(or Developers) would know more details on this.

5.In the certificate and key management settings, check if the certificate is listed under "API client certificate".If yes, it is being used in your code somewhere.

2

Enabling some features in Salesforce results in a new self-signed certificate being created. This certificate eventually expires. You can read more in this help documentation.

Self-signed certificates are commonly used for Single Sign-On settings (in 'Request Signing Certificate' or 'Assertion Decryption Certificate' field) or callouts to external sites (for client authentication). A certificate authority-signed (CA-signed) certificate is then used to prove that your org’s data communications are genuine.

If you receive this notification, open the mentioned organization and go to Setup | Security | Certificate and Key Management. Here you should see the certificate which matches the name provided in the notification.

The article then goes on to explain how to deal with this, if necessary.

Note that this also suggests your Sandbox is rather old. You might want to consider refreshing it soon.

4
  • Thank you, sfdcfox. But note:
    – willeg
    Aug 8, 2022 at 12:03
  • (continued)<br/>- the org referenced in the notification mail does not show any certificates in Certificate and Key Management. - instead it shows the message You've created 0 non-expired certificates out of a limit of 50 (the certificate shown in the mail notification expires August 16th, so it should appear in the list - how can the fact that I get this mail be explained then?
    – willeg
    Aug 8, 2022 at 12:27
  • it turns out I was looking at the wrong org - Sorry for the bother
    – willeg
    Aug 15, 2022 at 19:23
  • @willeg No need to apologize. At least you figured it out. That's the important thing.
    – sfdcfox
    Aug 15, 2022 at 19:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .