4

For callouts that need to implement mutual auth in SSL (aka 2-way SSL) with your own, self-signed cert: Drop your cert + private key into a JKS keystore and import it via Certificate and Key Management admin UI. Even though JKS supports a cert-only entry, that won't work here. SF will only import a JKS with one or more entry of type PrivateKeyEntry. The ...


3

The error is telling you exactly what is wrong. Your cert is missing vital information. The only thing you'll be able to do is provide the error to the issuer and request a new cert. If you want to be extra thorough, google some examples of a certificate online and compare them to the text in your cert to make sure they have the same format before you ...


2

When using mutual authentication/2-way SSL, Salesforce.com can present a self-signed certificate to the target host. Please check below links it will useful to you: https://help.salesforce.com/articleView?id=000007225&type=1 https://developer.salesforce.com/forums/?id=906F00000009B2uIAE https://help.salesforce.com/articleView?id=...


2

You can use one CA signed certificate in multiple places as long as that CA signed certificate is valid and can be used in authentication by external system. You can export CA certificate in .jks format from one sandbox and import it in any sandbox. https://docs.releasenotes.salesforce.com/en-us/winter15/release-notes/rn_forcecom_security_certificates.htm


2

Salesforce does not publish information about which version of OpenSSL they use (or if they use an alternative). Even if they did, we have no way of choosing which version Salesforce uses. Salesforce is a "managed" platform, meaning that they take responsibility for keeping the various bits and pieces updated (and more crucially, that these updates ...


2

I have not faced this issue recently, but because you mentioned the change on root CA (root Certification Authority), I suggest you check the Salesforce article that explains about certificates. Especially the part of /cacerts.jsp to your instance URL and compare with the server certificate that Salesforce is communicating with. Also, check if the whole ...


1

Client Credentials grant type is not supported by Salesforce. Recommended (and better) alternative for app-to-app calls is JWT Bearer.


1

The certificate chain this external endpoint is using is broken (which they would need to fix, it's not something we can take care of on the Salesforce side), or they're using a root CA that doesn't appear on Salesforce's list of trusted certs. There's not much you could do about a non-trusted root certificate, and the certificate chain thing is just a ...


1

In case others run across this in a similar search... The basic answer is "no". The issue arose because certificate validation was a security requirement. This was solved by making an initial call from Apex with the certificate to get an OAuth token from behind the firewall and the pass that token to the Visual Force page. Maybe not the most elegant solution,...


1

For starters, Set Up a Mutual Authentication Certificate: On the Certificate and Key Management page, click Upload Mutual Authentication Certificate. Note If you don’t see this option on the Certificate and Key Management page, contact Salesforce to enable the feature. Give your certificate a label and name and click Choose File to locate the ...


Only top voted, non community-wiki answers of a minimum length are eligible