Salesforce Mutual Authentication Setup
In this article
Mutual Authentication Setup
To enable mutual authentication in Salesforce, follow these steps:
Log into the Salesforce portal.
Navigate to Setup > Security Controls > Certificate and Key Management.
By default, you cannot view the Mutual Authentication Certificate section. In such a case, you need to raise a request to the Salesforce Support team to enable this section.
Once this section is enabled, you need a CA signed certificate to upload in this section. See “Create CA signed certificate” for more information.
Once you have the CA signed certificate, click Upload Mutual Authentication Certificate.
Provide a label and name for your certificate.
Click Choose File to locate the certificate.
Click Save to save the upload.
Create a custom profile to enable the “Enforce SSL/TLS Mutual Authentication” user permission for an
API Only
user.
This API Only
user configures the API client to connect on port 8443 to present the signed client certificate. If you are using a certificate chain, the client certificate must include any intermediate certificates in the chain when contacting port 8443.
Creating CA Signed Certificate
To create a CA Signed Certificate:
Log into the Salesforce portal.
Navigate to Setup.
Enter Certificate and Key Management in the Quick Find box, and then select Certificate and Key Management.
Select Create CA-Signed Certificate.
Enter a descriptive label for the Salesforce certificate. This name is used primarily by administrators when viewing certificates.
Enter a unique name. You can accept the name that’s populated based on the certificate label you enter.
Note: Use a unique name when referring to the certificate using the Lightning Platform web services API or Apex.The name can contain only underscores and alphanumeric characters, and must be a unique name in your org.
It must begin with a letter, not include spaces, not end with an underscore, and not contain two consecutive underscores.
Select a key size for your certificate and keys.
For securing data in transit through TLS, we recommend you to use the default 2048-bit key size.Enter the following information. These fields are combined to generate a unique certificate.
Common Name: The fully qualified domain name of the company requesting the signed certificate, generally of the form