5

I'm working on a project that is integrating Salesforce with a 3rd party API. They require us to pass a client certificate. Our admin created a CSR in Salesforce and got it signed by DigiCert. However we are having a problem getting the 3rd party server to trust our certificate. I think it may have something to do with the chain of trust:

DigiCert -> DigiCert SHA2 Secure Server CA -> OurCertificate

According to this Link, DigiCert (DigiCert Global Root CA) is trusted by Salesforce, but the intermediate (DigiCert SHA2 Secure Server CA) is not.

Would this have an impact on our ability to use the Client Certificate? And is there anything that can be done to make it work?

  • anyone out there? – NSjonas Oct 2 '14 at 15:02
2

You need to concatinate two certificates - your signed one and intermediate one. This literatally means opening notepad, copy and paste one cert after another, so you end up with this:

-----BEGIN CERTIFICATE-----
BASE64DATABASE64DATA
BASE64DATABASE64DATA
BASE64DATABASE64DATA
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
BASE64DATABASE64DATA
BASE64DATABASE64DATA
BASE64DATABASE64DATA
-----END CERTIFICATE-----
| improve this answer | |
1

I got it to work for one of our customers. You need to include the complete certificate chain (primary [your domain], intermediate [DigiCert SHA2 Secure Server CA], and root [DigiCert] certificates) in a single certificate, add it to a Java Key Store, and then import it into Salesforce. I think that even if you skip the root cert, it should still work, b/c SF already has it.

| improve this answer | |
0

I am having a similar issue upgrading to SHA256 for my client certs. Can't find any information on this. Here is what Salesforce Help told me which makes no sense:

"Looks like the server is relying on Salesforce's trust of Verisign's older intermediate certificates. Salesforce doesn't trust Verisign's newer intermediate certificates directly, and servers that switch to Verisign's newer intermediate certificates will need to configure their server to include those Verisign intermediate certificates in the ServerHello message's signing chain.

A decision was made to not add any more intermediate certificates to Salesforce's list of trusted certificate authority certificates, so this will necessitate customers who had been relying on Salesforce's trust of Verisign's older intermediate certificates to configure their servers to include Verisign's newer intermediate certificates in their server's ServerHello response message during the TLS negotiation."

It appears they think the issue is related to the server validation and not the client auth part of the handshake. I have added the new CA to the chain, but that does not affectt he client certs, just the server cert. The server cert works fine when Salesforce.com uses the old client cert.

Annoying as hell. I will let you know if I find anything.

| improve this answer | |
  • We resigned the cert using a Veri-sign instead of Digicert and it worked for us. Really annoying. – NSjonas Dec 2 '14 at 17:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.