Definition
Certificate and Key Management is a Setup page where administrators create, manage, and store digital certificates and key pairs used for secure communications. These certificates are used for SSL/TLS encryption, single sign-on, mutual authentication with external systems, and signing SAML assertions.
Real-World Example
The admin at FinServe Bank navigates to Certificate and Key Management to create a self-signed certificate for authenticating API callouts to their payment processor. She generates a 2048-bit RSA key pair, downloads the public certificate to share with the payment processor, and references the certificate in the Named Credential configuration.
Why Certificate and Key Management Matters
Certificate and Key Management is essential for secure external integrations in Salesforce because it provides a centralized location to generate, store, and manage digital certificates and cryptographic key pairs. Unlike generic admin features, Certificate and Key Management directly enables mutual authentication, API encryption, and SAML assertion signing—critical security requirements when Salesforce communicates with external systems like payment processors, identity providers, or enterprise middleware. Without proper certificate management, organizations expose sensitive data transfers to interception and cannot establish the trust relationships required for secure single sign-on or authenticated callouts. This feature is the backbone of Salesforce's compliance with standards like SAML 2.0, OAuth, and HIPAA-regulated data exchange.
As organizations grow and integrate more external systems, poor certificate management becomes a major operational and security risk. Certificate expiration without renewal causes integration failures that cascade across business processes—payment processing halts, user authentication breaks, and API integrations silently fail. Real-world consequences include security breaches when expired or poorly managed certificates are replaced with insecure workarounds, regulatory violations in financial and healthcare sectors, and costly incident response. Enterprises managing dozens of integrations can lose track of certificate lifecycles, leading to unexpected downtime. Proper Certificate and Key Management governance, including rotation schedules, audit trails, and secure storage, directly prevents these costly failures and maintains compliance posture.
How Organizations Use Certificate and Key Management
- SecurePayments Inc. — SecurePayments Inc., a fintech startup, used Certificate and Key Management to establish mutual TLS authentication with their payment gateway provider. The security team generated a 2048-bit RSA key pair in Setup, downloaded the public certificate to provide to the payment gateway, and then configured a Named Credential with the certificate to sign all outbound payment API calls. This eliminated the need to store API keys in code and reduced their audit findings from 7 to 0 during their SOC 2 assessment.
- HealthConnect Solutions — HealthConnect Solutions, a healthcare integration platform, leveraged Certificate and Key Management to implement SAML single sign-on with multiple hospital networks. They created self-signed certificates for signing SAML assertions, configured separate certificates for each partner organization, and established a certificate rotation policy. By centralizing certificate management in Salesforce Setup rather than distributing certificates across environment variables, they simplified compliance auditing and reduced the risk of certificate misuse.
- GlobalTrade Logistics — GlobalTrade Logistics used Certificate and Key Management to secure bi-directional authentication with their customs clearance software and ERP systems. They imported a third-party CA certificate, generated a client certificate for mutual TLS, configured it in multiple Named Credentials for different endpoints, and set automated reminders for certificate renewal 90 days before expiration. This approach enabled them to onboard 15 new external integrations in a single quarter without security rework or certificate-related integration failures.