I have some Apex code that uses:

Crypto.signWithCertificate('RSA-SHA256', Blob.valueOf(token), 'CertificateName')

and ideally would like to be able to create a named certificate in the unit test. But I don't see any way to do that. Is there a way?

(At the moment my unit test relies on a named certificate already being present and that works though certificates are not mentioned in the "such as" list of Isolation of Test Data from Organization Data in Unit Tests.)

  • "such as" means examples. It's not an exhaustive list. – sfdcfox Sep 18 '14 at 13:57
  • @sfdcfox Sure; my thinking is if it was mentioned the chances of an API being available to make this stuff more testable would be lower. – Keith C Sep 18 '14 at 14:07

You may want to take a look at the Crypto Sign with Certificate page from the Apex Code Developer's Guide. That page shows the following example:

Blob data = Blob.valueOf('12345qwerty');
System.Crypto.signWithCertificate('RSA-SHA256', data, 'signingCert'); 

The difficulty might be with creating the signingCert in your test class. From the above referenced page:


Type: String

The Unique Name for a certificate stored in the Salesforce organization’s Certificate and Key Management page to use for signing. To access the Certificate and Key Management page from Setup, click Security Controls | Certificate and Key Management.

It would appear the question would be whether you could simply assign a string as a the name of the certificate (I didn't try) or whether you'd need to find some way of accessing Certificate and Key Management from within a Test Class. I wasn't able to locate where certificates could be found in the Object Reference, but perhaps this will provide you with some kind of clue on how to locate what you need to accomplish creating one from within a test class.

| improve this answer | |
  • I've seen this documentation; the problem is that there appears to be no API that a test can use to create a named cert (your 'signingCert') on the fly. – Keith C Oct 22 '14 at 15:12
  • I wondered if that might not be the case. I had noticed that with the Crypto.sign(algorithmName, input, privateKey); method, one was essentially doing the same thing where privateKey was essentially the equivalent to a named certificate except that it was defined using EncodingUtil.base64Decode(key). In any case, I had thought it worth posting to see if it might lead to a solution. – crmprogdev Oct 22 '14 at 15:21

Looks like the answer is "no" at least in Winter '15.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.