Its a callout ,Whenever I try to connect with Secured Gateway, it fails I have given then client certificate of salesforce env. Do you think Iam missing anything here .Please help


When a client certificate (it has to be CA signed of course) is used to authenticate user, server/gateway has to somehow recognize appropriate certificates. That is easy to understand when you visit some website which requires a client certificate and popup shows with some certificate listed. As you might concluded there are not presented all certificates, but just some certain ones.

To achieve the same behaviour, you have to put CA public key into CA.crt file on server which will "match" client certificate. In other words, your gateway needs to recognize client cert and the only way this is possible, that gateway includes public key of CA which signed that client certificate (just concatenate all possible CA public keys into one file). See below.

Try this:

  1. Create CSR (in SF)
  2. Sign that with CA private key (you have to create CA key)
  3. Include CA public key (in Apache this property is called SSLCACertificateFile)

Or this:

  1. Covert your existing client certificate which is CA signed to keystore (jks file)
  2. Import that jks to SF with Import from keystore command.

Or this:

  1. Retrieve public key from Salesforce.com (it states here that all self-signed certificate inside SF are signed by Salesforce) https://help.salesforce.com/HTViewHelpDoc?id=security_keys_about.htm&language=en_US
  • HI @Simon, can you please elaborate on how to convert the existing client cert to keystore? – Quest_sfdc Sep 17 '18 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.