Outbound Messages 2 way SSL with Self-Signed Certificate

Question

I'm trying to configure 2 way SSL between SFDC and a 3rd party server (layer7), using outbound messages.

On the SFDC side I've selected a self-signed certificate (following this documentation). The certificate has been imported in the server's trust store and the server has been configured to request a cert for the outbound messages.

When an outbound message is fired, it fails in SFDC with the following message:

Policy Falsified

Whereas on the server side (looking at the logs) it says:

No client certificate was present

I'm wondering whether I've missed something or self-signed certs are not supported in this flow?

Answer 1

Per the documentation you linked:

Don’t include the root certificate authority certificate. The root certificate isn’t sent by your server. Salesforce already has its own list of trusted certificates on file, and a certificate in the chain must be signed by one of those root certificate authority certificates.

Self-signed certificates will not work, because there must be a trusted root CA at the end of the certificate chain. However, it doesn't have to be a cert signed directly from a CA. Assuming you already have a CA-issued certificate, you can create a new certificate and sign it with your certificate that you received from the CA (thus creating a chain of trust), and then you can validate against this other certificate. You'll need to include all certificates in the chain, except for the root, as outlined in that documentation. You may create a certificate solely for this mutual authentication method, but it must be signed by a higher authority.