Overview

To enable mutual authentication in Salesforce, you need to configure a CA-signed certificate and upload it to Salesforce. This guide walks you through the complete setup process.

Enable Mutual Authentication

1. Log into the Salesforce portal.
2. Navigate to Setup > Security Controls > Certificate and Key Management.
3. By default, you cannot view the Mutual Authentication Certificate section. If this section is not visible, raise a request to Salesforce Support to enable it.
4. Once the section is enabled, you need a CA-signed certificate to upload. See "Creating CA Signed Certificate" below.
5. Click Upload Mutual Authentication Certificate.
6. Provide a label and name for your certificate.
7. Click Choose File to locate the certificate.
8. Click Save.
9. Create a custom profile to enable the "Enforce SSL/TLS Mutual Authentication" user permission for an API Only user.

Creating CA Signed Certificate

1. Log into the Salesforce portal.
2. Navigate to Setup.
3. Enter "Certificate and Key Management" in the Quick Find box, and then select Certificate and Key Management.
4. Select Create CA-Signed Certificate.
5. Enter a descriptive label for the Salesforce certificate. This name is used primarily by administrators when viewing certificates.
6. Enter a unique name. You can accept the name that's populated based on the certificate label you enter.
   Note: Use a unique name when referring to the certificate using the Lightning Platform web services API or Apex. The name can contain only underscores and alphanumeric characters, must be unique in your org, must begin with a letter, not include spaces, not end with an underscore, and not contain two consecutive underscores.
7. Select a key size for your certificate and keys. For securing data in transit through TLS, use the default 2048-bit key size.
8. Enter the following information (these fields are combined to generate a unique certificate):
   • Common Name: The fully qualified domain name of the company requesting the signed certificate (e.g., www.mycompany.com).
   • Email Address: The email address associated with this certificate.
   • Company: The legal name of your company.
   • Department: The branch of your company using the certificate.
   • City: The city where the company resides.
   • State: The state where the company resides.
   • Country Code: A two-letter code indicating the country (e.g., US for United States).
9. Click Save. The certificate and corresponding keys are automatically generated.
10. Find your new certificate from the certificates list, then click Download Certificate Signing Request. Downloaded certificate signing requests have .CSR extensions.
11. Send the certificate request to the certificate authority of your choice (e.g., GoDaddy).
12. After the certificate authority returns the signed certificate, go back to Certificate and Key Management, click the name of the certificate, then click Upload Signed Certificate. The CA-signed certificate must match the certificate created in Salesforce.
13. Click Save to complete the upload process.

Certificate Chain Requirements

The certificate chain order must meet the following requirements:

• Start with the server or client certificate and then add its signing certificate.
• If more than one intermediate certificate exists between the server or client certificate and the root, add each certificate as the one that signed the previous certificate.
• The root certificate is optional and generally should not be included.

Additional Helpful Commands

See Also

• Setup of Mutual Authentication
• Creating CA Signed Certificate
• Testing Mutual Authentication