根据 CA/Browser Forum 关于 Transport Layer Security（TLS）服务器最新要求，TLS 证书的最大有效期将按照以下方式分阶段缩短。这些要求不受阿里云上的 Salesforce 控制，且所有证书供应商都必须遵守 CA/Browser Forum 的相关规则：
2026 年 3 月 15 日前：最大有效期为 398 天
自 2026 年 3 月 15 日起：最大有效期为 200 天
自 2027 年 3 月 15 日起：最大有效期为 100 天
自 2029 年 3 月 15 日起：最大有效期为 47 天
请注意：自签名证书不受此次生命周期调整影响，现有证书的到期时间也不会因此发生变化。
为确保服务连续性和数据传输安全，建议您采取以下措施。如未及时轮换即将过期的证书，可能导致自定义域名或 API 集成出现服务中断。
建议措施
自定义域名管理：若您配置了自定义域名，请审查证书有效期和续费流程，确保证书持续有效。
审查证书锁定 (Certificate Pinning)： 如果您的应用或集成使用了证书锁定，必须在轮换日期前确保中间件和集成系统信任新的证书链。
兼容性测试： 强烈建议在 Sandbox 环境中针对新证书链测试您的集成和连接应用，验证 SSL/TLS 客户端库和信任库是否能接受更新的证书层级。
API 客户端检查： 确认连接 REST/SOAP API 的客户端信任库包含新证书链的根证书和中间证书。过时的 Java 运行时或旧版中间件是常见的兼容性隐患。
密钥轮换： 定期轮换您的 SAML 和平台加密密钥。
更多信息
Certificates in Salesforce（注意：其中 Salesforce CDN 在阿里云上的 Salesforce 不可用）
According to the latest Transport Layer Security (TLS) server requirements issued by the CA/Browser Forum, the maximum validity period for TLS certificates will be shortened in phases as follows. These requirements are outside the control of Salesforce on Alibaba Cloud, and all certificate vendors must comply with the rules of the CA/Browser Forum:
Before March 15, 2026: Maximum validity period is 398 days
Starting March 15, 2026: Maximum validity period is 200 days
Starting March 15, 2027: Maximum validity period is 100 days
Starting March 15, 2029: Maximum validity period is 47 days
Please note: self-signed certificates aren't subject to the new lifespans, and there’s no change to the expiration date on existing certificates.
To ensure service continuity and secure data transmission, we recommend that you take the following actions. Failure to rotate expiring certificates in a timely manner may result in service disruptions for custom domains or API integrations.
Recommended Actions
Custom Domain Management: If you have configured custom domains, review certificate expiration dates and renewal processes to ensure that your certificates remain valid.
Review Certificate Pinning: If your applications or integrations use certificate pinning, you must ensure that your middleware and integration systems trust the new certificate chain before the rotation date.
Compatibility Testing: We strongly recommend testing your integrations and connected applications against the new certificate chain in a Sandbox environment to verify that your SSL/TLS client libraries and trust stores accept the updated certificate hierarchy.
API Client Review: Confirm that the trust stores used by clients connecting to the REST/SOAP APIs include the root and intermediate certificates for the new certificate chain. Outdated Java runtimes or legacy middleware are common sources of compatibility risk.
Key Rotation: Periodically rotate your SAML keys and Platform Encryption keys.
More Information
Certificates in Salesforce(Please note: Salesforce CDN is not available in Salesforce on Alibaba Cloud)
Alibaba Cloud SSL Certificate Management Version Change Description