Importing KvK NL CRT certificates to the Salesforce org

Question

our end goal is to import the following certificates in our salesforce org so that https://ssltest.kvk.nl/ is trusted by our salesforce org.

Certificates are provided at the following link: https://developers.kvk.nl/guides

There are 4 CRT certificates: One is Root CA, 2x Intermediate CA, and one certificate for the api.kvk.nl

Is there any way how we can combine these certificates into one and import them in salesforce in the format that will be accepted? or maybe import them one by one if that is possible?

Thank you!

Answer 1

I'm afraid you're out of luck on this one.

If you're making a callout (in Apex) from Salesforce to some external site, then that site needs to present a valid certificate chain that ends up pointing to one of the root CAs that Salesforce has approved (just append /cacerts.jsp to your Salesforce base url, e.g. https://cs123.salesforce.com/cacerts.jsp).

The list is too long to reproduce here. The important point is that the old Staat der Nederlanden cert is on the list but the new root cert is not on that list, and Salesforce does not provide any method for customers to add/remove/modify that list. It doesn't even look like their new cert is trusted by Firefox yet (though that could just be due to active directory shenanigans by my company).

The certificates we can add to Salesforce can be presented (by Salesforce) to external systems, but the issue lies in the other direction (the cert the target site is presenting to Salesforce).