We have enabled Mutual Authentication in our system. We are facing some issues while external system is trying to connect.

Below is the error details when we tried to handshake. The connection from external client (logstash connector) to the test salesforce endpoint through port 8443 failed with a TCP Reset behaviour (captured through a network tcpdump trace). This resulted in a "Connection reset by peer" error message on the client side. No logs seen in salesforce. ==> It seems there is no HTTPS listener on port 8443

Could you please help us fix this issue.

Setup Done so far in salesforce: - The external client provided the SIgned certificate in the form of .cert file and .Jks (keystore format). - Mutual Authentication has been enabled in salesforce and the "enable TLS/SSL Mutual Authentication" and "API Only USer" permission has been provided for the required integration user - The Keystore was imported under the Certificate and Key Management section and the Certificate was added under mutual authentication table.

Thanks in Advance!

  • Hi SFDC Learner, As i am not aware about your issue in mutual tls, but you can help me to setup mutual tls for one of my project. i need to setup mutual tls to expose an api to external system but i don't have that much of info on how to setup. i really appreciate if you could tell me that how can i generate certificate for this mutual tls, what will be the CN name in CSR? Please help – Dildar Hussain Apr 10 '17 at 9:52
  • The Mutual authentication must be enabled by Salesforce. Once enabled, you will have a new section added to the the certificate and Keys setting. There you will have to add a SF generated certificate or external certificate signed by SF approved CA authority in the required format – SFDC Learner Apr 17 '17 at 11:32
  • I had similar problem. Have you found a solution to this? – Patlatus Dec 5 '17 at 11:27
  • The issue was fixed at the external system. However please make sure if SF IP ranges are whitelisted , host name in the certificate and target are same , set the endpoint as the actual url with my domain if enabled instead of test.salesforce or login.salesforce.com. Hope this helps – SFDC Learner Dec 5 '17 at 16:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.