I am importing the Salesforce SSL certs for the test.salesforce.com and our sandbox environment using the commands below in a VM server environment.

Import test.salesforce.com or login.salesforce.com cert based on the box being hit

  1. java -jar InstallCert.jar test.salesforce.com
  2. keytool -exportcert -alias test.salesforce.com-1 -keystore jssecacerts -storepass changeit -file testsalesforcecom.cer
  3. C:/Software/jdk1.8.0_251/jre/lib/security/cacerts -storepass changeit -file testsalesforcecom.cer

Import sandbox specific cert (Example SIT)

  1. java -jar InstallCert.jar sandbox-domain.my.salesforce.com
  2. keytool -exportcert -alias sandbox-domain.my.salesforce.com-1 -keystore jssecacerts -storepass changeit -file sitsalesforce.cer
  3. keytool -importcert -alias sandbox-domain.my.salesforce.com -keystore C:/Software/jdk1.8.0_251/jre/lib/security/cacerts -storepass changeit -file sitsalesforce.cer

Importing the certificates for the urls works the current day but next day the outbound bulk api authentication call fails with a certificate path error: Exception: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Are we importing the correct SSL cert to add to the trust store? Any help would be greatly appreciated.

  • hi @ShreyasD, I have a similar issue. I'm unable to conenct to my trial enterprise org from a local application (Still in development). How do I resolve this? What is the InstallCert.jar? Can you pls provide some details? Mar 22 at 6:11

1 Answer 1


The issue was a SSL Inspection proxy on the firewall that created a dummy certificate daily for all communications outbound to Salesforce.com. The resolution was to whitelist all domains *.salesforce.com to bypass the SSL proxy.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .