Salesforce’s certificate email is easy to forward and hard to answer. Someone still has to open the org and see which certificates are doing two jobs, which ones a partner uses to log in, and which ones will come back shorter at the next renewal. MiaForce Check does that read for you. You sign in with your own Salesforce user, approve access, and get a report. The org is not modified.

New to the email itself? Read the plain-English explanation first. Admins who want the renewal rules and the metadata details can use the technical guide.

What you do

Open checktool.miaforce.com and choose the org, production or sandbox. Salesforce asks you to log in, then shows the access MiaForce Check is requesting: permission to read data through the API. You approve it. Salesforce sends the tool a short-lived token. The tool reads certificate records and writes the report.

You do not create an app in your org. You do not paste a password, a session id, or a private key. MiaForce owns the app registration. Your user is the one granting access, so the report shows the org you actually logged into, including the My Domain, so a sandbox is not mistaken for production.

Some companies block outside apps until an admin allows them. If Salesforce stops the login for that reason, an admin allows MiaForce Check once. That is a permission, not a project.

What the report is looking for

A certificate is a digital ID. The 2026 rule changes hit public IDs that were bought from a certificate company, not every file sitting in Setup. The report sorts what it can see into three groups.

  • Needs attention. A public certificate that can both identify a website and log a system in. Public issuers are stopping that combination. The file you have keeps working until it expires. The renewal may not. The same flag appears when one certificate is wired up as a client login and as the certificate on your own web address.
  • Review. A certificate used only to log a system in, or a partner certificate uploaded so that partner can call Salesforce. The report names the issuer. If that issuer is not one Salesforce has said it will trust for inbound logins, someone needs to confirm the next purchase before the old certificate expires. A custom-domain certificate with a long life is listed here too: it is valid until the printed date, and the next public one will be shorter.
  • Out of scope. Self-signed certificates used to sign single sign-on or a JWT. Those are a different kind of ID. The shorter public lifetimes do not apply to them.

A row in “Needs attention” is not an outage. It is a renewal that will fail if nobody splits the certificate first.

What a clean report does not prove

Salesforce does not expose everything the email talks about. The report always includes a “not checked” list, including when nothing was flagged.

  • Which certificate is selected as the org’s API Client Certificate. That choice is a dropdown in Setup. The API does not say which row is selected. Someone still has to look.
  • Certificates on Salesforce’s own addresses, such as *.my.salesforce.com. Salesforce replaces those, unless you uploaded a certificate for a custom domain.
  • Trust lists on your own servers: Java, an API gateway, a proxy, or MuleSoft. A laptop that can open Salesforce does not mean those servers can.
  • Private keys. The check never receives them, and it will not ask you to upload a keystore.

So “no findings” means “nothing in the certificate records we could read matches the dual-use pattern.” It does not mean the email can be archived.

After the report

Leave the old certificate in place until the new one has been tested on a real connection. Deleting it the same day you upload the replacement is how a planned renewal becomes your own outage. The dates that matter are still the renewal dates in your org, then 1 March 2027 for DigiCert’s client-use cutoff and 15 March 2027 for the broader public rule. The technical guide has the inventory steps if you want to repeat the check with the Salesforce CLI.

When you leave the tool, the login ends. A later check asks Salesforce for permission again.

Frequently asked questions

Does the check change my org?

No. It reads certificate records and where they are referenced. It does not upload, delete, or rotate anything.

Do I have to create an app?

No. You sign in and approve access. If your org blocks outside apps, an admin allows MiaForce Check once.

Does a clean report mean we are done?

No. The API Client Certificate dropdown, Salesforce-hosted certificates, and trust lists on servers such as MuleSoft are outside the scan. The report says so every time.