I have been breaking my head to get the Mutual Authentication(MTLS) to work in Salesforce for a while but with little success. I am trying this out on a sandbox by enabling this feature and by assigning the required permission set to the API only user.

I have tried with both a Self-signed certificate and with a certificate signed by a CA internal to our company but it gives me different errors for both. As mentioned in this blog, is it mandatory to generate certificates only from the list of predefined CAs to get it to work even in sandboxes? I assume I would have to spend some money to get one such certificate which sounds unreasonable considering the fact that I am trying this on a sandbox.

The following are the errors I get

Certificate error: unable to get local issuer certificate

Certificate error: self signed certificate in certificate chain
  • Please also make sure that the "full chain" is in your certificate digicert.com/kb/ssl-support/pem-ssl-creation.htm Dec 3 '20 at 13:48
  • @BryanAnderson, I do not have any intermediate certificates. So, I don't think I need to worry about the chain part. Or do I?
    – Anee
    Dec 3 '20 at 13:53
  • help.salesforce.com/… "The API client needs to send a client certificate chain - the client certificate along with all intermediate certificates that exist in the trust path between the client certificate and its root certificate - to Salesforce during the TLS handshake" Dec 3 '20 at 14:18
  • I finally managed to get the right certificate to be used and when I try to get userInfo with the certificate, I get nothing in the response. Somewhere in the response, I see this message 'ALPN, server did not agree to a protocol'. I am at least happy it doesn't speak anything about the certs. Any idea how will I be able to find out what's going wrong?
    – Anee
    Feb 6 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.