Renewing an Expiring Salesforce Certificate for CloudSense Integration

Symptom

A notification is received that a Salesforce certificate used for CloudSense integration is expiring soon. If the certificate expires without renewal, CloudSense services (Configurator, Solution Management, Orchestrator Accelerator, etc.) will lose connectivity to the Salesforce org.

Cause

Salesforce certificates have an expiration date. CloudSense services authenticate with the Salesforce org using these certificates. When a certificate expires, all API communication between CloudSense backend services and the org fails.

Resolution

Step 1: Generate a new certificate (Salesforce Admin)

1. In Salesforce, go to Setup > Certificate and Key Management
2. Download the existing certificate for backup
3. Generate a new self-signed or CA-signed certificate

Step 2: Share the new public key with CloudSense

1. Extract the public key from the newly generated certificate
2. Send it to: CSHerokuSecurity@cloudsensesolutions.com
3. Coordinate a suitable time window for the update with the CloudSense provisioning team

Step 3: Coordinated update (simultaneous)

At the agreed time, both sides must update simultaneously:

• CloudSense provisioning team: Updates the public key on the CloudSense infrastructure side
• Customer Salesforce Admin: Updates the certificate name in the CloudSense custom settings within the Salesforce org (e.g., csam__AsyncMessOptions__c, csutil__Configurator_Options__c, or other relevant custom settings that reference the certificate name)

Step 4: Test integrations

After the update:
1. Test that CloudSense services connect successfully (e.g., open a basket, perform Calculate Totals)
2. Verify that no authentication errors appear in the browser console or debug logs

Step 5: Clean up

Once the new certificate is confirmed working, delete the old certificate from Salesforce Certificate and Key Management.

Additional Notes

• The simultaneous update in Step 3 is critical -- if the CloudSense side updates before the Salesforce side (or vice versa), there will be a connectivity gap during the mismatch window
• Plan the update during a low-traffic period to minimize impact
• After sandbox refreshes, certificates may need to be re-configured as sandbox copies may reference the old certificate