I am making an HTTP POST request to external system, it works fine when I post request from Developer orgs, these orgs are of older versions. However when I build a package and install that package into a new org and when I try to connect to external system using HTTP POST I get this HandShake error.

Error: Something went wrong. Please try again.Remote host closed connection during handshake

One reason that I thought of is, Salesforce has disabled TLS 1.0 , Salesforce is requiring an upgrade to TLS 1.1 or higher by July 22, 2017 in order to align with industry best practices for security and data integrity. On that date it will disable TLS 1.0. But the API that I am hitting using post confirms that its still accepting TLSv1, handshake error result via open SSL, inside of external system network.

Does new Salesforce orgs that I am creating has TLS 1.1 or higher enabled by default? and external system is not accepting request because of change in version for TLS. https://c.na34.visual.force.com/apex/MyVFPage <- this one succeeds on connection https://packageNameSpace.ap5.visual.force.com/apex/MyVFPage <- this one fails These are callback URLS.

When I check the critical updates in my old org I can see like following:-
enter image description here

However new Salesforce orgs that I am creating does not have this in Critical updates, does that mean new Salesforce orgs already having version of TLS 1.1 or higher enabled by default, if YES how to check version of TLS?

I did activate TLS 1.1 or higher under critical updates section assuming there might be some issue with TLS, also external system confirms that they accept TLS V1.0, V1.1,V1.2 and V1.3
enter image description here

When I tried to connect to external system after activating this update , all seems to be working fine in the old Salesforce orgs that I am using, however new Salesforce orgs that I am creating, having issue shaking hands with external system.

Any thoughts how to approach this issue.
Note: I can not post code here because of the security reasons, it will be helpful if anyone can guide me about this.

3 Answers 3


I'm pretty sure you are following This Article, however, you should continue monitoring it for updates.

  • All orgs already support TLS 1.1 and TLS 1.2
  • New orgs will automatically have TLS 1.0 disabled.
  • No sandbox orgs support TLS 1.0 any longer.

New production orgs created with Summer '16 or later

TLS 1.0 is disabled by default. New production orgs created with Summer ‘16 or later will have the "Require TLS 1.1 or higher for HTTPS connections” Critical Update Console (CRUC) setting auto-enabled. This will disable TLS 1.0 by default.

Sandbox orgs June 25, 2016, at 9:30 AM PDT (16:30 UTC)

After this date and time, all sandbox orgs -- whether existing, refreshed, or new -- will have TLS 1.0 automatically disabled and will require TLS 1.1 or later in HTTPS connections to or from the sandbox org. The "Require TLS 1.1 or higher for HTTPS connections" CRUC setting will not be available.

Production orgs

July 22, 2017 9:30 a.m. PST (17:30 UTC)

NOTE: The disablement for orgs will not occur over a staggered period. All org types will have TLS 1.0 disabled based on the date and time stamp outlined above.

In a nutshell, yes, the orgs you have created use TLS 1.1 or higher.

  • But how to approach this issue as for old org its working and new ones that I am creating its not, what should be the solution approach? Commented May 31, 2017 at 13:20

Orgs created after January 23, 2017, do not have the option to enable TLS 1.0 in the CRUC (i.e Critical Update Console (CRUC) setting). Currently, Salesforce has automatically disabled TLS 1.0 from the sandbox org. It means that "Require TLS 1.1 or higher for HTTPS connections" CRUC setting will not be available.

For more help please refer following links:-

  1. Salesforce disabling TLS 1.0

  2. TLS 1.0 Disablement Critical Update Console (CRUC) Setting


Issue that we were facing is because IP white-listing was not done at third party server side.

When I was creating Salesforce org selecting country as the India I was facing the handShake issue, while if I am creating the Salesforce org by selecting country as the United States I wasn't.

There are IP ranges provided by Salesforce which we need to white-list at third party server in order to perform a successful callout.

More Details can be found in following article
Ref: What are the Salesforce network IP addresses that I need to whitelist?
(Quoting from the Article)
Salesforce understands the importance of security and that customers need to be confident that they are communicating with Salesforce in a secure environment. IP whitelisting is one of the most effective methods of ensuring this and prevents any internet traffic intended for Salesforce from being hijacked or rerouted to a rogue website. In order to ensure a secure connection, we provide the complete list of our public IP addresses. We have exclusive ownership of every public IP address that we use. The IP addresses that we use have been allocated directly to us by The American Registry for Internet Numbers (ARIN), The Asia Pacific Network Information Centre (APNIC), and Réseaux IP Européens (RIPE). These organizations are coordinated by the Internet Assigned Numbers Authority (IANA) and the Internet Corporation for Assigned Names and Numbers (ICANN).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .