I would like to use Self-Signed CA of Salesforce to build a 2-way SSL connection with my Web Server. The Web Server is built on Apache 2.2 and the 1-way SSl test is fine. In the 2-way SSL test, the CA-Signed certificate of Salesforce is OK.

When I use Self-Signed CA of Salesforce, it seems the Apache can't verify the client CA from Salesforce.

I use Openssl to verify the client CA, like,

openssl verify -CAfile SFDC.cer  SFDC.cer

and got the following error,

error 20 at 0 depth lookup:unable to get local issuer certificate

I guess there is something wrong with Salesforce's self-signed CA.

Does anyone have the same experience?

| improve this question | | | | |
  • I'm confused; my SF orgs show VeriSign SSL certs. What "Self-Signed CA of Salesforce" are you referring to? Is this a cert you created? – Mike Chale Dec 13 '12 at 16:16
  • I mean not the server CA, but the client CA of Salesforce. You can create it from Security Controls -> Certificate and Key Management -> Create Self-signed Certificate – Jia Hu Dec 20 '12 at 4:54

This is a known bug of the latest versions of macports' port of openssl 1.0.1 and has nothing to do with Salesforce's self-signed CA.

See this link for reference and a workaround


I hope this helps.

| improve this answer | | | | |
  • Thanks for your info. I will confirm it. The problem is that I got early same error message from Apache Web server. like, [error] [client] Certificate Verification: Error (20): unable to get local issuer certificate Then I guess, maybe Salesforce Self-signed CA can't certificate itself. – Jia Hu Dec 20 '12 at 4:56

I have blogged 5-part article series about setting up a two-way SSL authentication with Salesforce and you can find it here. Though this article deals with Salesforce and IBM Websphere Cast Iron, the technique and most of the steps applies to Apache as well. Check it out to see if that helps.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.