0

Pardon me for my complete ignorance(even after reading a lot on this) but would like to get community's view on following questions:

  1. While I know for 2-way SSL authentication, we need to generate certificate(self signed/CA signed depending upon requirement). My question is little broader- why we as Salesforce customer, need to generate/upload and provide certificate(s)? Salesforce supports Https/TLS, Why Salesforce certificates are not sufficient and we need to upload/generate our own certificates

  2. Is it because our domain(*.my.salesforce.com) is subdomain and Salesforce mightn't have paid for subdomains while buying certificates from CA? Is same argument valid for communities custom domain which can be completely different.

  3. Why for outbound message/Ajax proxy, we just need to generate API client certificate provided by salesforce itself and it is not something we've to purchase. Why same functionality can't be extended to other functionalities(Salesforce as Idp/ web service call outs etc)?

1
  • What is the specific use case for which you've needed to generate a certificate? Are you trying to implement 2-way authentication, SSO, something else? If you're making a callout to some third-party system, Salesforce can't provide you a certificate for that system.
    – David Reed
    Jun 20 at 0:00
0

Salesforce supports Https/TLS, Why Salesforce certificates are not sufficient and we need to upload/generate our own certificates

Two-way SSL requires a certificate on both ends. It is typically not a generic, public HTTPS certificate, but rather private certificates that provide encryption and authenticity for the other platform. In that sense, each certificate acts as a passphrase that tells the other end the connection is authorized.

Is it because our domain(*.my.salesforce.com) is subdomain and Salesforce mightn't have paid for subdomains while buying certificates from CA? Is same argument valid for communities custom domain which can be completely different.

No, Salesforce uses public wildcard certificates for that purpose. A wildcard allows any subdomain to be valid if the top-level domain matches. This is often used in multi-instance systems like Salesforce so you don't have to keep issuing new certificates every time you add a subdomain.

Why for outbound message/Ajax proxy, we just need to generate API client certificate provided by salesforce itself and it is not something we've to purchase. Why same functionality can't be extended to other functionalities(Salesforce as Idp/ web service call outs etc)?

Because it's between the client and the server, not between two servers or two clients. Other systems cross networks and so need to be authenticated.

1
  • thanks, it cleared some doubts!
    – sfdc_Qrius
    Jun 21 at 6:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.