I am integrating a third party webservice to salesforce and wondering if I can implement Two Way SSL Certificates for authentication.

I will have to generate a self-signed certificate, share it with third party so that they can add it to their keystore.

What I want to know is does all the third party webservice will support such mechanism or do I need to confirm with that.

Also,When will I have to create CA-signed certificate,does this also depend on third party.



I'm not too sure what mechanism you have in mind. One I have used for server to server interaction based on pre-created certificates is the OAuth 2.0 JWT Bearer Token Flow. Salesforce supports that and as it is a well known standard there is a good chance that the third party web service does too.

Straight from the documentation:

  1. The developer creates a connected app or uses an existing one and can optionally register an X509 Certificate. The certificate corresponds to the private key of the app. When the connected app is saved, the Consumer Key (OAuth client_id) and Consumer Secret are generated and assigned to the app.
  2. The developer writes an app that generates a JWT and signs it with the certificate.
  3. The JWT is posted to the token endpoint https://login.salesforce.com/services/oauth2/token or, if implementing for a community, https://acme.force.com/customers/services/oauth2/token (where acme.force.com/customers is your community URL).
  4. The token endpoint validates the signature using the certificate registered by the developer.
  5. The token endpoint validates the audience (aud), issuer (iss), validity (exp), and subject (sub) of the JWT.
  6. Assuming that the JWT is valid and that the user or admin authorized the app previously, Salesforce issues an access_token.

Steps 2 and 3 are what your third party web service would need to do.

Also see Digging Deeper into OAuth 2.0 in Salesforce.

  • I am talking about Setup -->Security Controls--> Certificate and Key Management .As per documentation ,Here A self signed certificate can be generated and shared it to third party.It sounds pretty simple,so I want to know if this can be used for authentication with any third party. – devsfdc Nov 4 '17 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.