9

Most of my clients who ask for a public portal or site on salesforce want two things:

  1. SSL
  2. personally branded site

They like being able to manage everything through salesforce but they dont want their public image affected by salesforce specific url strings etc.

The solution I have typically put forth is to put an ngnix/apache proxy in front of the site.

This solution also allows for the url to go from this <customer.urn>.force.com => someting.<customer.urn>

does anyone have another solution that works for them, maybe something on platform?

Improve this question
4
  • does the proxy allow full https traffic ? We have the same issue and didn't think of this. Native to salesforce there is no solution for this as far as the documentation states.
    – Samuel De Rycke
    Commented Aug 21, 2012 at 14:58
  • 1
    @Sdry - Definitely no native Salesforce support. Here is the related idea which is "Under Consideration": success.salesforce.com/ideaView?id=087300000006nxH.
    – Peter Knolle
    Commented Aug 21, 2012 at 15:02
  • it does, you are basically going full https from client -> proxy -> SF
    – ebt
    Commented Aug 21, 2012 at 15:10
  • except this question was asked two years ago. who's duplicating who?
    – ebt
    Commented Aug 15, 2014 at 18:21

3 Answers 3

Reset to default
6

The historic difficulty with allowing SSL with custom web addresses is that the SSL negotiation takes place based on IP addresses. Thus the SSL certificate has to be bound to a specific IP address and presented when a client makes an SSL connection to that IP address. Name based hosting, which allows a site to represent itself as a custom address is a feature of HTTP(S), as the name is encoded in the HTTP request headers, but these aren't presented until the SSL connection is established. Thus SFDC would need to provide a unique IP address to for every site that used SSL and custom web addresses, something that is unlikely to scale.

Server Name Identification solves this problem by adding the hostname to the SSL handshake, but for this to work both the browser and server need to support it and a lot of older browsers don't. The problem here is that if the browser doesn't support SNI, it gets the default certificate for that IP addresses, which raises a security alert, which is probably a worse user experience than using .secure.force.com.

Improve this answer
2
  • Interesting. Do you have any insight into how Salesforce might be planning on implementing the idea they have under consideration? success.salesforce.com/ideaView?id=087300000006nxH. I wonder if it will be similar to developers.google.com/appengine/docs/ssl?
    – Peter Knolle
    Commented Aug 22, 2012 at 10:28
  • I've assumed they would use SNI. Virtual IP addresses have been around for a while, but they tended to have patchy OS support (though its been a long time since I used it - back then Linux didn't have support). All guesswork I'm afraid. Probably the biggest issue for SNI right now is that Internet Explorer on XP doesn't support it, which cuts out a lot of browser.
    – Bob Buzzard
    Commented Aug 22, 2012 at 12:17
5

So for SSL with salesforce sites it seems that the way to go is still a reverse proxy.

Improve this answer
2

In Force.com Sites, there is a functionality to use a Custom Web Address which will let you specify your own domain. For example:

Instead of: "mycompany.force.com" You can use: "www.mycompany.com"

However, this solution doesn't allow SSL, meaning you can't do https. If you go to the https custom url, e.g. "https://www.mycompany.com/", then you'd get a certificate warning.

I know there are a few pilot customers who are working with Salesforce to trial a SSL version of the custom web address. Your clients should talk with their Salesforce reps to find out if they can do this for their sites.

Improve this answer
2
  • 1
    Are you 100% certain that there is a full SSL trial for custom domains on Sites? I had an issue related to this escalated the entire way up the chain a few months ago and never got any remote indication that this was actually on a roadmap. If it's currently in pilot it would have had to have been fully developed at that point. It's huge news if true, since this has been sorely needed functionality for years.
    – jkraybill
    Commented Aug 22, 2012 at 3:31
  • The folks at Activision will tell you that this got done for them, and they're using it in production today.
    – Shane McLaughlin
    Commented Aug 22, 2012 at 14:01

Not the answer you're looking for? Browse other questions tagged .