6

Marketing folks would like to add the traditional "secure" graphic from verisign/etc. we authenticate through the customer portal and customers make e-commerce transactions on our site.

Normally you would download a script from your SSL vendor and it shows the cert icon.

I don't know how that works since salesforce is hosting the site. Do they say who the signer is or offer any way for us to pass that along to our users?

Like this https://sealinfo.verisign.com/splash?form_file=fdf/splash.fdf&dn=WWW.salesforce.com&lang=en

Goal is to have *.secure.force.com validated to the customer.

5
  • Don't you just provide a link on your page for that? – Mike Chale Jun 23 '13 at 19:38
  • Are you doing e-commerce on your site? If so, more than anything else, that's what the verisign seal would be for. They'd handle the security during your check-out process. The other thing they'd handle would be your site url certificate validation with the user's browser. Beyond that, you could be using anyone's Oauth or other security validation at log-in and it wouldn't matter. I don't believe they do any of that for you. – crmprogdev Jun 24 '13 at 14:04
  • Yes, it's commerce. I updated the question – Shane McLaughlin Jun 25 '13 at 12:45
  • So you are looking to display a graphic within the pages of your site / customer portal, which shows the validity of the SSL certificate at the hosting site *.secure.force.com? – Mark Pond Jun 25 '13 at 22:32
  • Mark, yes, exactly! – Shane McLaughlin Jun 26 '13 at 2:24
3

If you go to your https force.com domain using Chrome and click on the padlock icon in the browser bar next to the URL you can see that the issuer is Cybertrust SureServer Standard Validation CA, which is owned by Verizon.
chrome ssl image

According to the SureServer SSL product information page, their package includes the Cybertrust Secured Website Seal which could be embedded with a link to the Verizon Cybertrust Security Certification Verification, probably by an html snippet provided by Verizon.

I am not aware of any documentation from Salesforce for embedding and linking to their Cybersturst seal(s). I suggest contacting Salesforce support to see if they have a more definitive answer.

3
  • Peter, that's very helpful. I had posted this one to Salesforce support and they were completely stumped. – Shane McLaughlin Jun 26 '13 at 17:50
  • Peter, I looked into that and it appears the seals are part of a certification program, not tre standard SSL check. Obviously we're in the cloud to avoid having to do perimeter security audits, etc. any other thoughts? – Shane McLaughlin Jun 29 '13 at 3:30
  • sounds like you can't link to a seal. You could always link to the data center security page. Only other thing I can think you explain your end goal of being able to provide information about the security of your site to the end users to someone at Salesforce support and see if/what sort of standard they have for that (might not be a "seal"). – Peter Knolle Jun 29 '13 at 10:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.