I just received an email informing that the default Salesforce client certificate (proxy.salesforce.com) will retire on August 7, 2017 at 09:30 a.m. PDT (16:30 UTC).

They say customers using the following features may be impacted:

  • Single Sign-On using Service Provider (SP)-Initiated SAML
  • Delegated authentication
  • Workflow automated messaging
  • AJAX proxy
  • PageReference.getContent() Apex call
  • PageReference.getContentAsPDF() Apex call

As an administrator and developer who has an app that uses getContentAsPDF calling a page within the organization (getting the pdf of a visualforce rendered as PDF), should I be concerned about the highlighted feature?


Steven Lawrence from Salesforce answered me on November 14 about this, at the Salesforce Success Community Group about Salesforce Infrastructure. His answer was:

Fortunately, this change does not affect calls to PageReference.getContentAsPDF() or PageReference.getContent() when the PageReference object is for another resource within the org, such as for a Visualforce page.

The concern instead is for when the PageReference uses an external URL for a remote endpoint that requests or requires a client certificate. It's somewhat of an edge case, but is nevertheless a possible scenario that is affected. Fortunately, content within an org, including Visualforce pages, is not affected by this change.


I'm happy to say that it is already possible to update the API Client Certificate in the Certificate and Key Management page to be either No Certificate or a self-managed (either self-signed or CA-signed) certificate. This is available in all orgs -- sandbox and production.

The source entry can be found here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.