When we do callout via SOAP, it uses either TLS or SSL. Can we restrict salesforce to use TLS instead of SSL.

  • Wouldn't the protocol used be defined by the SOAP web service? If the web service only supported TLS and not the older SSL then you should be set. Also, maybe incorrectly, I'd assume that Salesforce would use the most secure method possible (TLS). – Daniel Ballinger Oct 21 '14 at 1:28

Recent email from Salesforce


As an administrator of a Salesforce org that may have recently been accessed using SSL 3.0 encryption, we want to inform you of a change regarding supported encryption protocols. Over the next two months, Salesforce will be disabling SSL 3.0 encryption in a phased approach to prevent it from being used to access the Salesforce platform.
Why is this happening?.
At Salesforce, trust is our #1 value, and we take the protection of our customers' data very seriously. On October 15, Google researchers published details on a security vulnerability (CVE-2014-3566) that affects the Secure Socket Layer (SSL) 3.0 encryption protocol, also known as “POODLE,” which may allow a man-in-the-middle attack to extract data from secure HTTP connections. Although the vulnerability is somewhat difficult to exploit, to further protect customers, we will be disabling SSL 3.0 to fully address this issue.
How do I know if we are ready for this change?
After Salesforce disables SSL 3.0 encryption, any channels connecting to Salesforce will need to use TLS 1.0 encryption or higher. There are three different channels that require encryption to access Salesforce: internet browser, API (inbound) integrations and call-out (outbound) integrations. Here is an overview of each:

  • Internet Browsers: By default, all browsers supported by Salesforce have TLS 1.0 enabled. You and your users should not experience an impact accessing Salesforce in your browser(s) unless you are either using a non-supported browser or you have disabled TLS 1.0 in the browser. To quickly test your browser compatibility, you can visit https://developer.salesforce.com, which has SSL 3.0 disabled. If you are able to view the site without errors, access to Salesforce via your browser should not be impacted by this change. Internet Explorer (IE) 6, which is not officially supported by Salesforce, is capable of handling TLS 1.0 encryption, but it is not enabled by default. If you have users on IE 6 and would like assistance on how to enable TLS 1.0, please log a case via the Help & Training portal.
  • API (inbound) Integrations: API Integrations are interfaces or applications that are separate from Salesforce, but use Salesforce data. If you have any API Integrations, please ensure TLS 1.0 encryption or greater is enabled in the integration.
  • Call-out (outbound) Integrations: Call-outs are integrations where Salesforce refers to an outside source to either verify login credentials or pull data. Examples of call-outs include: Delegated Authentication Single-Sign-On (SSO), Outbound Messaging and Apex call outs. If you use call-out integrations, please ensure TLS 1.0 encryption or greater is enabled in the integration.

What action do I need to take?
In order for users to continue to have seamless access to your Salesforce orgs, you need to ensure their browsers and integrations have TLS 1.0 encryption or higher enabled. If your browser or integration does not have TLS 1.0 or higher enabled after we make this change, then your users will not be able to access Salesforce. Additionally, we recommend you disable SSL 3.0 encryption in your own IT environment as soon as possible, unless you use call-out integrations. If you use call-out integrations, and you have not already disabled SSL 3.0, we recommend that you wait until after we have disabled SSL 3.0 for outbound requests in our environment.

When will Salesforce disable SSL 3.0 encryption?
Salesforce plans to disable SSL 3.0 encryption according to the following schedule: For Inbound Encryption Requests (Internet Browsers and API Integrations)

Instances SSL 3.0 Disable Schedule All Sandbox InstancesFriday, November 7, 2014 NA17, NA19, NA20Friday, November 14, 2014 NA2, NA4, NA13, NA15, NA16, EU0, EU2, EU3Friday, November 21, 2014 NA7, NA8, NA9, NA10, NA11, NA12, NA14, EU1Friday, November 29, 2014 NA0, NA1, NA3, NA5, NA6Friday, December 5, 2014 AP0, AP1Monday, December 15, 2014

For Outbound Encryption Requests (Call-out Integrations) Instances SSL 3.0 Disable Schedule All Sandbox InstancesWednesday, December 3, 2014 All Production Instances Wednesday, December 10, 2014

Where can I get more information? You can review this Knowledge Article for more information. If you have any questions, please reach out to your Salesforce contact or log a case via the Help & Training portal.

|improve this answer|||||
  • Hi @Daniel Ballinger , we are making callouts to SAP system and get data from there. What changes should i made to SFDC side as well as SAP side? Please clarify it is very urgent for us so that we are in a position to tell our client. – Bforce Nov 3 '14 at 17:03
  • 1
    @BaskaranS Since it is Salesforce calling out to SAP you need to ensure that the hosted SAP web services support TLS 1.0 at a minimum. Ideally they would also support higher versions such as TLS 1.2. This will ensure you will continue to receive callouts from Salesforce when SSL 3.0 support is turned off. To be more secure you could be proactive and turn off SSL 3.0 support sooner. Try scanning the current service with ssllabs.com/ssltest/analyze.html – Daniel Ballinger Nov 3 '14 at 21:05
  • 1
    @BaskaranS Actually, I'd belay removing SSL 3.0 support if Salesforce is calling out it it. You could be connection errors until they completely remove support of the 10th of December. See SSLv3 Poodle vulnerability & outbound messaging – Daniel Ballinger Nov 4 '14 at 0:52
  • Thanks a lot @Daniel for the nutshell information which i think definitely would help me in this issue. Thanks again. – Bforce Nov 4 '14 at 9:04
  • I will appreciate if any one can refer me to the SF documentation where it is explicit that it uses only TLS as encryption protocol for callouts, I mean specifically: SF invokes a external/public web service (WSDL). Thanks – Tamia Ramirez Sep 27 '16 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.