2

We are trying to make a callout to "https://support.dreamwares.com/payment/v1/accounts/somevalue" from Salesforce. But, we are facing an exception:

System.CalloutException: java.security.cert.CertificateException: No subject alternative DNS name matching support.dreamwares.com found.

The domain has a valid SSL certificate.

We have checked from SSL shopper: https://www.sslshopper.com/ssl-checker.html?submit=submit&hostname=support.dreamwares.com

But, still we are facing this issue

We don't understand why is Salesforce not allowing us to make call outs to this domain when it has a valid SSL certificate and the browsers allow it.

We understand that Salesforce only supports the certificates from trusted CA authorities as listed on

https://developer.salesforce.com/page/Outbound_Messaging_SSL_CA_Certificates

Our certificate provider is GoDaddy which is listed in the list in above link. Our our fingerprint matches with godaddyclass2ca

Simple steps to recreate the issue are as follows-

  1. Create a remote site setting for URL - "https://support.dreamwares.com"
  2. Execute the following code from developer console -

    HttpRequest httpReq = new HttpRequest();
    Http httpObj = new Http();
    HttpResponse httpResp = new HttpResponse();
    
    httpReq.setEndPoint('https://support.dreamwares.com/payment/accounts/orgid'); 
    httpReq.setMethod('GET');
    
    httpResp = httpObj.send(httpReq);
    
  3. The execution will fail. Check debug logs for details of exception

What is the reason for this issue?

0

It turns out, as you said, that you can't have multiple certificates on the same IP address. Why every other browser and network service can handle this but Salesforce can't, I have no idea.

We were using a shared hosting provider, and once we got a dedicated IP address and put our sub-domain on that dedicated IP address, it worked.

Now, if only Salesforce would update it's error message to include the fact they don't work with wildcards or multiple certs on one IP address.

stony

2

It means that the webiste you are calling with HTTPS has a domain name that is different from what you're using. i.e you're calling "https://api.myservice.com", and the website's certificate is only for www.myservice.com, you get this error.

It can also happen when multiple certificates are hosted on the same IP address or the certificate is a wildcard certificate i.e. *.breadwinnerhq.com

1

We are using wildcard certificate for our domain which works absolutely fine. Search for a utility called SSLPoke if you get successfully connected it will sure work with salesforce

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.