Configuring Salesforce Mutual Authentication (mTLS) with Client Certificates

What Is Mutual TLS (mTLS)?

Mutual TLS (mTLS), also known as Mutual Authentication or two-way SSL/TLS, is an enhanced security protocol that requires both the Salesforce server and the connecting client application to present valid digital certificates during the TLS handshake. This is different from standard TLS, where only the server presents a certificate.

How Standard TLS Works

In a standard TLS connection (one-way authentication):

1. The client connects to the Salesforce server.
2. The server presents its SSL certificate to the client.
3. The client validates the server's certificate against a trusted Certificate Authority (CA).
4. An encrypted session is established.

Only the server is authenticated in this model. The client is not required to prove its identity.

How Mutual Authentication (mTLS) Enhances Security

In an mTLS connection:

1. The client connects to the Salesforce server.
2. The server presents its certificate (as in standard TLS).
3. The server also requests a certificate from the client.
4. The client presents its own certificate, issued by a trusted CA.
5. The server validates the client certificate.
6. Only after both certificates are validated is the encrypted session established.

This ensures that only clients holding a valid, trusted certificate can communicate with Salesforce — effectively preventing unauthorized API access even if credentials are compromised.

Prerequisites

Before configuring mTLS:

• Obtain a valid client certificate issued by a trusted Certificate Authority (CA). The certificate must include the "Client Authentication" Extended Key Usage (EKU) value.
• Self-signed certificates are not recommended for production mTLS configurations. Use a CA-signed certificate.
• Identify the Salesforce integration user that will use mTLS authentication.