Authorization using certificates

Question

I want to know the process of authorization or authentication using self-signed certificates.

I am trying to integrate two salesforce dev orgs using REST callouts. I have created a self-signed certificate (named: 'TestCertificate') under certificate and key management section, exported it to keystore (.jks file generated) in one org say 'Org A' and imported the same .jks file in another org say 'Org B'.

Now i am trying to callout from org A to org B using http. below is the code snippet:

HttpRequest httpReq = new HttpRequest();
httpReq.setMethod('GET');
httpReq.setEndpoint('https://login.salesforce.com/services/data/v43.0/sobjects/account/describe');
httpReq.setClientCertificateName('TestCertificate');
Http http = new Http();
HttpResponse response = http.send(httpReq);

(I have used my dev org domain name instead of login.salesforce.com). In response i am getting 401, Unauthorized error.

Could someone help with the process of authorization with certificates? is there any other details needs to be passed in the header? or How does certificates authorization works?

Answer 1

I do not believe that setClientCertificate() is used for what you are trying to use it for.

From the HttpRequest class documentation

setClientCertificateName(certDevName)

If the external service requires a client certificate for authentication, set the certificate name.

Authentication with Salesforce can make use of a certificate, but a certificate alone is insufficient.

When you're using a Salesforce API like the REST API, even if you're trying to make an API call to the same org you are making the API call from, you're executing some action on behalf of a user. A certificate alone doesn't tell Salesforce which user to execute the action as. Without a user, Salesforce couldn't apply any access controls to objects/records, fields, visualforce pages, etc...

To do what you're trying to do (API integration between two orgs), you'll need to authenticate as a user in the org you are making the API callout to by using a connected app and an oAuth2.0 flow.¹

For inter-org integration, I believe the JWT-Bearer flow is the most appropriate because it can be configured to not require a browser to log in (like pretty much every other flow requires) after initial setup.

^{1: This isn't the only way to do this, but the alternative is such bad practice that it's not even worth mentioning}