3

I would like to use Self-Signed CA of Salesforce to build a 2-way SSL connection with my Web Server. The Web Server is built on Apache 2.2 and the 1-way SSl test is fine. In the 2-way SSL test, the CA-Signed certificate of Salesforce is OK.

When I use Self-Signed CA of Salesforce, it seems the Apache can't verify the client CA from Salesforce.

I use Openssl to verify the client CA, like, 

openssl verify -CAfile SFDC.cer  SFDC.cer

and got the following error,

error 20 at 0 depth lookup:unable to get local issuer certificate

I guess there is something wrong with Salesforce's self-signed CA.

Does anyone have the same experience?

Improve this question
2
  • I'm confused; my SF orgs show VeriSign SSL certs. What "Self-Signed CA of Salesforce" are you referring to? Is this a cert you created?
    – Mike Chale
    Commented Dec 13, 2012 at 16:16
  • I mean not the server CA, but the client CA of Salesforce. You can create it from Security Controls -> Certificate and Key Management -> Create Self-signed Certificate
    – Jia Hu
    Commented Dec 20, 2012 at 4:54

2 Answers 2

Reset to default
4

This is a known bug of the latest versions of macports' port of openssl 1.0.1 and has nothing to do with Salesforce's self-signed CA.

See this link for reference and a workaround

https://stackoverflow.com/questions/11774961/unable-to-connect-to-test-salesforce-com-with-ssl

I hope this helps.

Improve this answer
1
  • Thanks for your info. I will confirm it. The problem is that I got early same error message from Apache Web server. like, [error] [client 182.50.78.8] Certificate Verification: Error (20): unable to get local issuer certificate Then I guess, maybe Salesforce Self-signed CA can't certificate itself.
    – Jia Hu
    Commented Dec 20, 2012 at 4:56
2

I have blogged 5-part article series about setting up a two-way SSL authentication with Salesforce and you can find it here. Though this article deals with Salesforce and IBM Websphere Cast Iron, the technique and most of the steps applies to Apache as well. Check it out to see if that helps.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .