0

One of the salesforce security considerations for outbound messages is:

If the configuration of your application (endpoint) server's SSL/TLS allows, validate the identity of the Salesforce server when it takes the role of a client to your server, using the Salesforce client certificate. For instructions to download the certificate, see Downloading the Salesforce Client Certificate.

Source

Which certificate shall I use self-signed or signed by a certificate authority?

Improve this question

1 Answer 1

Reset to default
1

In your code, on the third-party server, you shall use the Salesforce Client Certificate to validate that the call is coming from Salesforce. This is a certificate you can create in Setup either by creating a self-signed certificate or uploading a CA cert. This is to verify that the incoming call is a legitimate Outbound Message, rather than a spoofed message by an unknown client.

Improve this answer
3
  • Hi @sfdcfox, How can I get that Salesforce Client Certificate? I am looking under settings in "Certificate and Key Management" but in there I have the option to create a self-signed certificate or an CA signed certificate but I do not see any certificate created by the system.
    – Cuban coffee
    Commented May 10, 2023 at 12:39
  • @Cubancoffee You're right. It's been a while since I've used this feature, like probably eight years ago. I think I assumed that because the system creates a cert in new orgs automatically the first time, or it used to. You can create either a self-signed cert or use a CA cert. Make sure you specify that cert in the Manage API Client Certificate screen. You'll need to periodically update the cert in Setup as it expires. If using self-signed from Salesforce, make sure it's downloadable (the default option).
    – sfdcfox ♦
    Commented May 10, 2023 at 13:06
  • thanks a lot. Now I get it.
    – Cuban coffee
    Commented May 10, 2023 at 19:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .