6

I am using the function Crypto.sign(algorithmName, input, privateKey) from the Crypto class as follows:

String algorithmName = 'RSA';
String key = '';
Blob privateKey = EncodingUtil.base64Decode(key);
Blob input = Blob.valueOf('12345qwerty');
Crypto.sign(algorithmName, input, privateKey);

What I want to do is generate a private key and public key from the Salesforce environement. That is to say dynamically and not from my command prompt (using openSSL). Is it possible ?

Improve this question
5
  • 2
    This question is better posed than the original that you deleted, but my question from your original remains. Why don't you use one or two-way authenticated callouts? If all you're looking to do is protect data in transit from one system to another, that should be sufficient. Why is generating a public/private key pair and storing it somewhere in Salesforce not an option?
    – Derek F
    Commented Mar 29, 2017 at 20:49
  • What are you going to do with those keys? Sounds like you're just signing it and throwing away the key if you're just keeping it in SF. Not sure how that authenticates anything.
    – Charles Koppelman
    Commented Mar 29, 2017 at 21:11
  • @DerekF It doesn't look like he's encrypting the data, rather signing it - that is, authenticating himself as the data's author.
    – Charles Koppelman
    Commented Mar 29, 2017 at 21:13
  • 1
    Here's a quick post on what signing a message means: crypto.stackexchange.com/questions/9896/…
    – Charles Koppelman
    Commented Mar 29, 2017 at 21:18
  • Yes you are right , I would like to authenticate myself as the data's author. This is the reason that I am using Crypto.Sign() , so I need a private public key generated from the salesforce's environement
    – Raphym
    Commented Mar 29, 2017 at 21:27

1 Answer 1

Reset to default
2

Under Setup -> Certificate and Key Management you will find two options for doing so:

  1. Create Self Signed Certificate: creates/signs a private & public certificate. Will not be recognized by trust stores, but can be useful for internal applications

  2. Create CA-Signed Certificate: Will create a private key and a CSR which you can then have signed by a Root CA, and upload back into salesforce.

You can then use the crypto signWithCertificate & verify methods which accept a certDevName as a parameter.

NOTE: The private key is NOT accessible directly from apex.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .