Can anyone guide me how to Enable the Enforce SSL/TLS Mutual Authentication user permission for API client user.



1 Answer 1


For starters, Set Up a Mutual Authentication Certificate:

  1. On the Certificate and Key Management page, click Upload Mutual Authentication Certificate.

Note If you don’t see this option on the Certificate and Key Management page, contact Salesforce to enable the feature.

  1. Give your certificate a label and name and click Choose File to locate the certificate.
  2. Click Save to finish the upload process.
  3. Enable the “Enforce SSL/TLS Mutual Authentication” user permission for an “API Only” user. This “API Only” user configures the API client to connect on port 8443 to present the signed client certificate.

then you can follow this documentation, it's pretty straightforward:

After you've set up mutual authentication, log in to the Salesforce service using port 8443. Include your credentials and your signed certificate information. For example, your configuration using cURL may look something like this, where “@login.txt” contains the login Soap message with your credentials and “fullcert.pem:xxxxxx” is your certificate information:

curl -k https://login.salesforce.com:8443/services/Soap/u/31.0 -H "Content-Type: text/xml; charset=UTF-8" -H "SOAPAction: login" -d @login.txt -v -E fullcert.pem:xxxxxx

Once a session ID is returned from your call, you can perform other actions, such as queries. For example:

curl -k https://yourInstance.salesforce.com:8443/services/Soap/u/31.0 -H "Content-Type: text/xml; charset=UTF-8" -H "SOAPAction: example" -d @accountQuery.xml -v -E fullcert.pem:xxxxxx

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .