function readOnly(count){ }
Sign Up ›
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
Learn More

Browse by Topic
ShowAll Questionssorted byDate Posted
+ Start a Discussion
All@RXAll@RX 

Secure Http Request With SSL SNI Certificate

Hi,

 

We have just deployed some Https Webservice that are certified with SSL through reverse proxy that supports SNI (http://en.wikipedia.org/wiki/Server_Name_Indication).

 

With the simple Outbound Message it works fine, but with WebserviceCallout or with HttpRequest we got the following error :

-IO Exception: java.security.cert.CertificateException: No subject alternative DNS name matching "Server Name" found.

 

 

Do the both mecanisms (OutboundMessage and HttpRequest) have different libraries underneath ?

 

Thank you,

 

 

Mayank_JoshiMayank_Joshi

Hi , 

 

 

For more info ,please refer to below link : 

http://www.salesforce.com/us/developer/docs/apexcode/index_Left.htm#CSHID=apex_callouts_wsdl2apex.htm|StartTopic=Content%2Fapex_callouts_wsdl2apex.htm|SkinName=webhelp 

 

For that, you need to pass Certificate (Base64 converted value ) into the attribute :

 

clientCert_x

 

 

docSample.DocSamplePort stub = new docSample.DocSamplePort();
stub.clientCert_x =
'MIIGlgIBAzCCBlAGCSqGSIb3DQEHAaCCBkEEggY9MIIGOTCCAe4GCSqGSIb3DQEHAaCCAd8EggHb'+
'MIIB1zCCAdMGCyqGSIb3DQEMCgECoIIBgjCCAX4wKAYKKoZIhvcNAQwBAzAaBBSaUMlXnxjzpfdu'+
'6YFwZgJFMklDWFyvCnQeuZpN2E+Rb4rf9MkJ6FsmPDA9MCEwCQYFKw4DAhoFAAQU4ZKBfaXcN45w'+

All@RXAll@RX

Thank you for your answer, but I think it is not related.

 

We do One way SSL authentication, so there is no need of client certificate.

 

See this sample code :

 

HttpRequest req = new HttpRequest();
     req.setEndpoint('https://server_url');
     req.setMethod('GET');
Http http = new Http();
     HTTPResponse res = http.send(req);
     System.debug(res.getBody());

 The error returned is :

IO Exception: java.security.cert.CertificateException: No subject alternative DNS name matching "Server Name" found.

 

This is because SNI (see wiki link) can return a different certificate for the same IP.

 

I know that Java 7 support SSL SNI, but not Java 6.

 

 
Arnt mongoDBArnt mongoDB

we ran into the same issue. Our IT fixed it somehow on their server by installing another cert. Our CTO raised an eyebrow about the salesforce SSL implementation (apparently still using Java6 was his assumption?)
Mayank_JoshiMayank_Joshi
Thanks for the information :)
Arnt mongoDBArnt mongoDB
one more detail: we now call the server by the domain that matches the domain on the default certificate, so that it works even without SNI, which sfdc apparently doesn't support for apex callouts. Not a viable workaround in all environments maybe, but worked for us.
Jesper Kristensen 5Jesper Kristensen 5
I ran into the same problem today. Salesforce, can you confirm that you do not support SNI in Apex callouts? Any plans to fix this?
ck2ck2
Would really just like the official confirmation that SNI is not supported for Apex callouts. Salesforce devs, can you comment?
Steven LawranceSteven Lawrance
I just now saw this post, and I have good news to share. Salesforce has been using SNI in its callouts since the Summer '15 release earlier this year.