1

I am working on integrating Salesforce with a bespoke system using APEX Http callouts and one of the security requirements is to allow two way SSL. Apex supports this by allowing you to attach a certificate to the HTTP request:

https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_client_certs_http.htm

The security team need to know where this certificate is presented. At the application layer or at a lower layer of the OSI model. I have done a callout using a certificate to a HTTPs endpoint but cannot see any information regarding the certificate in either the headers or the body.

When using setClientCertificateName for an Apex HTTPs callout how is this certificate presented to the server?

2

TLS operates in OSI's Presentation Layer, which is one of three layers bundled together in what TCP/IP calls the Application Layer. HTTP sits atop TLS, so the certificate isn't in the header or body, but instead exists as part of the TLS handshake. Depending on the server and language, this may mean that there is an environment variable or some TCP API method you need to call.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.