Configure Certificate Credentials
Use a Certificate Credential when the external API requires a client certificate for the outbound request.
The certificate itself is managed in Salesforce Setup. The Credential stores the certificate name Payloads should use when it sends the callout.
Before you start
Create or upload the certificate in Salesforce Setup under Certificate and Key Management.
Copy the certificate's Unique Name from Salesforce. Use the Unique Name, not the label, when configuring the Credential.
Confirm with the external system that the matching public certificate has been registered on their side.
Configure the Credential
Create a Credential from the relevant Integration.
Set Type to Certificate.
Enter the Certificate Name from Salesforce Certificate and Key Management.
Save the Credential.
A Certificate Credential references the Salesforce certificate by unique name so Payloads can apply it to outbound callouts.
Attach it to a Payload
Open the outbound Payload that should use the certificate.
Select the Credential in the Payload header fields, then save the Payload.
Keep any separate API key, token, or custom authentication values in their own Credential if the external API requires more than certificate authentication.
What to check
Before testing, check that:
the Certificate Name exactly matches the Salesforce certificate Unique Name
the certificate has not expired
the external system trusts the matching public certificate
the Payload has this Credential selected
the endpoint is the environment that expects this certificate
After a test run, open the Job record and check the response status. Certificate trust problems are usually returned by the external system or connection layer before the API processes the request body.