7

I am trying to send an Http request from Salesforce to a third party system. Following is the code for http request.

    HTTP httpInstance = new HTTP();
    HTTPRequest request = new HTTPRequest();
    request.setEndpoint(endpointURL);
    request.setHeader('Content-Type','application/json');
    request.setHeader('srcKey', 'xxx-xxx-xxx-xxx');
    request.setMethod('POST');
    //request.setClientCertificateName(certificate);
    //request.setClientCertificateName('StudentScoutCertificateBase64');
    try{
        HTTPResponse newResponse = httpInstance.send(request);
        string responseBody = newResponse.getBody();
        system.debug('REST Response '+ responseBody);

    }catch(exception e){
        system.debug('An unexpected error occured: '+ e.getMessage());
    }

On sending the request I get a response back from the server with the following error.

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Certificate is valid on client's server. I did download the certificate with Base64 encoding . I then added the certificate using the following

request.setClientCertificateName(certificate);

I am then getting the following error.

common.apex.runtime.impl.ExecutionException: DER input, Integer tag error

Not sure how to proceed with this error. Any help is appreciated. Thanks!

Improve this question

2 Answers 2

Reset to default
5

I was able to figure out the issue. There were two reasons for this error.

  1. Certificate was not signed by one of the 100+ Salesforce trusted CA.
  2. Intermediate certificates were not installed on the client's server.

Once they fixed these two issues, I was able to successfully ping the server.

Following is the link you can use to check if the endpoint certificate is trusted or not

http://www.digicert.com/help/

Improve this answer
3
  • Glad you found the solution and thanks for coming back and adding the answer! You should be able to give yourself the check mark too!
    – Jesse Altman
    Apr 10, 2014 at 18:13
  • Would the cert not being signed by a Salesforce trusted CA be a problem in this case? setClientCertificateName() is so Salesforce can pass the certificate as part of a web service call, so a cert signed by a CA set up by yourself should work right? It's up to the receiver whether to trust the cert or not. I've been looking for confirmation this is the case or not, but am struggling.
    – GBreavin
    May 28, 2014 at 3:07
  • @GBreavin Yes, cert not being signed by a Salesforce trusted CA was the issue. However Salesforce also suggested similar thing what you are suggesting. The only thing receiver has to do is to add the new CA signed certificate in there server and that will work. However in my case the 3rd party was not willing to add any new certificates which we were providing but went ahead and got the certificate resigned by one of the Salesforce trusted CAs.
    – Yash Mehta
    Jul 11, 2014 at 17:28
0

Check the list of trusted cert providers Link for directions to install intermediate certificates

Improve this answer
1
  • Could you also explain or summarize that witin your answer?
    – Samuel De Rycke
    Apr 17, 2014 at 5:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .