Salesforce provides Mutual Authentication Certificate for inbound calls. These certificated are provided by external systems from where request will come into the salesforce and we upload it in salesforce system. I just want to know that how does salesforce validate this certificate for inbound request. What is the mechanism for it.

P.S:- Suppose we have exposed our web service for multiple external systems and all these systems provided their own certificates to salesforce. Now how salesforce validate certificate corresponding to the individual external system.


The best explanation I can find for someone who isn't especially familiar with this already is KB Article 000240864 Mutual Authentication to Salesforce.

For an inbound request, when the client connects to your organization's API endpoint on port 8443, it sends a client certificate request during the TLS handshake. The user handling the inbound request (an API only user) must have the "Enforce SSL/TLS Mutual Authentication" user permission enabled. The user passes the client's certificate identity information to the Salesforce application servers.

The client certificate's identity information is used to look up the mutual authentication certificate from the org. If the certificate is found and matches the client certificate that was sent to Salesforce, access is granted, but if it does not match or is not found, then access is denied. If no client certificate is presented by the API client, then access to Salesforce is denied.

For reference, here's a list of Outbound Messaging SSL CA Certificate Providers that Salesforce Servers are able to work with.

Your Answer

