Mutual Tls Callouts

Mutual TLS Callouts

Mutual TLS requires both sides to present certificates. Salesforce supports mTLS callouts via a client certificate stored in Setup → Certificate and Key Management, referenced from a Named Credential. This skill sets up the cert, the Named Credential, and a minimal Apex caller that proves the connection before shipping.

When to Use

Partner APIs that mandate mTLS (banks, healthcare EDI, some government systems).

Typical trigger phrases that should route to this skill: mtls salesforce callout, client certificate apex, mutual tls named credential, jks keystore apex.

Recommended Workflow

1. Generate a client keypair (or receive partner-signed cert) and import via Setup → Certificate and Key Management.
2. Create Named Credential referencing the certificate; set endpoint + authentication protocol 'Per User' or 'Named Principal'.
3. Write a small Apex probe: HttpRequest req; req.setEndpoint('callout:MyPartner/health'); new Http().send(req); and assert 200.
4. Schedule a daily probe job with alerting; cert expiry surfaces 30+ days ahead.
5. Rotate certificate annually or per partner policy.

Key Considerations

• Self-signed certs are fine for dev but production requires partner-signed.
• Certificate expiration surprises pages; monitor Certificate.ValidTo.
• Named Credential is the only supported place to reference client cert — do not try to ship JKS in Apex.
• CSR generation happens in Salesforce; private key never leaves.

Worked Examples (see references/examples.md)

• Bank ACH partner — Daily batch callout
• Expiry monitor — Prevent cert outage

Common Gotchas (see references/gotchas.md)

• CSR generated externally — Private key material uploaded; weaker security.
• Missing intermediate chain — Handshake fails.
• No expiry alert — Outage Friday night.

Top LLM Anti-Patterns (full list in references/llm-anti-patterns.md)

• Generating CSR externally
• Missing intermediate chain
• No expiry monitor

Official Sources Used

• Apex REST & Callouts — https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts.htm
• Named Credentials — https://help.salesforce.com/s/articleView?id=sf.named_credentials_about.htm
• Connect REST API — https://developer.salesforce.com/docs/atlas.en-us.chatterapi.meta/chatterapi/
• Private Connect — https://help.salesforce.com/s/articleView?id=sf.private_connect_overview.htm
• Bulk API 2.0 — https://developer.salesforce.com/docs/atlas.en-us.api_asynch.meta/api_asynch/
• Pub/Sub API — https://developer.salesforce.com/docs/platform/pub-sub-api/guide/intro.html