Salesforce can use a SSL certificate to authenticate itself with a third party server, but can a third party server authenticate with a Salesforce in the same manner? Our use case is that we have legacy apps that use non-authenticated REST calls, with a mediator that redirects those devices to the correct endpoint, such that the legacy apps do not need to ever have their configuration updated directly. We would like to be able to authenticate as a user and access custom REST web service methods without having to supply a username, password, or token, but still have the client authenticated by way of a SSL certificate, simply by installing the appropriate certificate.

  • According to the "Certificate & Key Management" page (Setup->Security Controls->Certificate & Key Management), "Mutual authentication certificates are used when an HTTPS request is made to a salesforce.com organization from a third-party service on a specified port. Contact your salesforce.com support representative to enable this feature." I've not used this (hence a comment instead of an answer), but it sounds like what you are looking for? Edit: found docs.releasenotes.salesforce.com/en-us/winter14/release-notes/… with more info. Commented Feb 13, 2014 at 16:41
  • I'm surprised I missed this. I'll look into it.
    – sfdcfox
    Commented Feb 13, 2014 at 18:45
  • @sfdcfox I was about to post a question about this - did you ever get any further with the link that Jason posted? The release notes don't make much sense to me, especially how the calls are tied to a specific user.
    – James
    Commented Jul 29, 2014 at 15:59
  • According to the documentation at help.salesforce.com/apex/…, the user still has to make a call to the login() SOAP method with the username and password to get a session token. Seems to up the security level at least, but doesn't negate the need for username / password.
    – James
    Commented Jul 29, 2014 at 16:23
  • I'm a little confused about the ask. It's unclear to me what you mean by authentication. If you're only concern is that an "authorized" client is accessing an "authorized" server, then 2-way SSL is the path to go. Instead, if you're looking for the client to provide some kind of user credential so the server can run under the privileges of a user, you may want to explore JWTLogin <doingpoorly.blogspot.com/2014/11/…>
    – tggagne
    Commented Jan 12, 2015 at 17:15

2 Answers 2


Salesforce supports it now, check the following documents that how to setup it and using methods:


If I understand you correctly, you want to make web service callouts from Salesforce org to your legacy apps behind the mediator. You will only need Two-Way SSL when making web service callouts from Salesforce org to external systems. See Making Authenticated Web Service Callouts Using Two Way SSL. You can install Apache HTTP server on your mediator and use it as a revers proxy to delegate requests to appropriate legacy apps. The Apache HTTP server deals with SSL configuration. You will need to install your external system's domain certificate on Apache server. Also you need to generate the certificate for Salesforce on the Apache server and upload the certificate back to the Salesforce org.

  • The other way around, actually. Legacy apps through mediator to salesforce.com. I found how to use SSL with other servers, but salesforce isn't going to be initiating the requests.
    – sfdcfox
    Commented Feb 20, 2014 at 17:27
  • So you are thinking to make certificate signing request to Salesforce and expect Salesforce to have a mechanism to generate the certificate so that you can install this certificate on your legacy system and then use it to communicate to Salesforce org without providing user name and password. I don't think Salesforce would like to do this. For one, Salesforce is not a Certificate Authority. Secondly, it would be much more difficult to recover if you lose the certificate than username/password. Last, it would be huge maintenance work on Salesforce.
    – user6941
    Commented Feb 20, 2014 at 17:51
  • I'm working with salesforce.com re: the comment on the question about using SSL certificates, actually, but we may end up going with SAML, which I found out was an option after posting the question. I do appreciate the answer here, though.
    – sfdcfox
    Commented Feb 20, 2014 at 18:02
  • @sfdcfox any luck on this? similar scenario- third party needs to make unauthenticated call to SF rest endpoint exposed through public site. they can however provide a certificate in their call. looking for a way in apex to validate their incoming certificate
    – nickforce
    Commented Nov 16, 2017 at 16:13
  • @nickforce Did you find out anything here? We're having the same requirement. I cannot see a way to validate the client certificate in our Apex implementation...
    – Christoph
    Commented Aug 6, 2021 at 9:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .