5

I'm building an integration to a third party webservice, and wanted to implement Two Way SSL Certificates based on this article

We started out using Digicert certificates, but after many hours of investigation by the network team, it seems Salesforces does not have the necessary root and/or intermediate certificates in their keystore to support the Digicert certificates.

Once we switched to Verisign Certificates, it worked just fine.

If you end up here, hopefully our experience will lessen the injuries caused by banding your head on a table...unless someone else has been able to use Digicert?

Improve this question
2
  • I think I bumped into a similar problem many moons ago - Experian root certs werent supported (only Root CA's trusted in the Java Keystore work)
    – techtrekker
    Feb 20 '13 at 23:44
  • We are having this same issue, think its them not supporting the intermediate certs... Although their support claims they do.
    – NSjonas
    Oct 2 '14 at 20:59
3

I know Salesforce supports at least some of the digicert root certificates as I have implemented this in production. I have blogged a 5-part article series on setting up two-way SSL authentication with Salesforce and you can find it here. Though this article deals with Salesforce and IBM Websphere Cast Iron, the technique and most of the steps applies to any other technology stack as well. Check it out to see if that helps.

Improve this answer
2

The most complete list of trusted certificates that I'm aware of is here. It appears that at least some Digicert certificates are supported. Were your certificates any of the following?

digicertassuredidrootca
digicertglobalrootca
digicerthighassuranceevrootca

Improve this answer
1

Just to second this: I have a client seeing this same behavior. They are running a wildcard certificate issued by "DigiCert High Assurance CA-3" whose root is "DigiCert High Assurance EV Root CA" (which is listed as a supported CA by Salesforce).

They have configured a test endpoint in their API manager (Layer 7) which requires 2-way SSL. This endpoint is set up exactly the same as other endpoints they use, which are successfully negotiating 2-way SSL with clients other than Salesforce. We have verified (using OpenSSL) that Layer 7 is presenting their certificate plus the intermediate DigiCert High Assurance CA-3 certificate.

The behavior they are seeing is that they have configured a simple outbound message workflow in Salesforce. When that outbound message is fired, Salesforce connects to their endpoint but fails the 2-way handshake because Salesforce fails to present the Salesforce client certificate.

I have found two other reports around the web from people that claim this exact same issue, also with DigiCert certificates. I have not found similar reports from other CA's. Report 1 Report 2

The only theory we have on this is that Salesforce simply does not correctly support DigiCert certificates. We thought that another theory could be that Salesforce does not support wildcard certs for 2-way SSL, but in digging into this that seems unlikely. I saw a note somewhere that Salesforce only supports wildcards to 1 level deep (i.e. "*.domain.com" would work for "my.domain.com" but not "my.deeper.domain.com"), but the client is only using a 1-level deep domain.

At this point, we have no solution other than to acquire a Verisign certificate and use that for the 2-way SSL, and are not 100% sure that will work. Based on us being at least the fourth person to report that DigiCert certs don't work with Salesforce 2-way SSL I'm pretty confident that this will be the solution.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.