Fix "Invalid Certificate Format" Error when Setting Up a Custom Domain in Okta
Sep 1, 2025
Okta Classic Engine
Okta Identity Engine
Administration
Overview
When setting up a Custom Domain, after pasting the generated certificate in the Certificate field, the following error messages are seen:
The certificate must not be a Certificate Authority (CA) certificate
and/or
Invalid certificate format
Applies To
- Custom Domain
Cause
Solution
To resolve the Invalid certificate format error, follow these steps:
- Generate the certificate from the DNS provider using PEM key format to ensure that the certificate is in a valid PEM-encoded RSA format.
- Okta does not accept Certificate Authority (CA) certificates. Therefore, the certificate being used must not be a CA certificate.
- Ensure that the certificate chain is in the correct order, starting from the top-level certificate authority down to the domain certificate.
NOTE: If still experiencing issues with setting up a custom domain, contact Okta Support for assistance.
