How do I install the Mutual Tls Callouts skill?

Run npx skillmds add pranavnagrecha/mutual-tls-callouts in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Mutual Tls Callouts safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts, makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Mutual Tls Callouts?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Mutual Tls Callouts free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Mutual Tls Callouts?

PranavNagrecha (@pranavnagrecha) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Mutual Tls Callouts by pranavnagrecha

Name: Mutual Tls Callouts
Rating: 4.2 (5 reviews)
Author: PranavNagrecha

Mutual Tls Callouts

Configure mTLS for Apex callouts using Named Credentials with client certificate authentication. NOT for standard TLS or API key auth — use architect/integration-security-architecture.

PranavNagrecha cf14ddb 7 files · 18.4 KB Updated Sep 8, 2026 15 repo stars

File contents

Mutual TLS Callouts

Mutual TLS requires both sides to present certificates. Salesforce supports mTLS callouts via a client certificate stored in Setup → Certificate and Key Management, referenced from a Named Credential. This skill sets up the cert, the Named Credential, and a minimal Apex caller that proves the connection before shipping.

Adoption Signals

Partner APIs that mandate mTLS (banks, healthcare EDI, some government systems).

Recommended Workflow

Generate a client keypair (or receive partner-signed cert) and import via Setup → Certificate and Key Management.
Create Named Credential referencing the certificate; set endpoint + authentication protocol 'Per User' or 'Named Principal'.
Write a small Apex probe: HttpRequest req; req.setEndpoint('callout:MyPartner/health'); new Http().send(req); and assert 200.
Schedule a daily probe job with alerting; cert expiry surfaces 30+ days ahead.
Rotate certificate annually or per partner policy.

Key Considerations

Self-signed certs are fine for dev but production requires partner-signed.
Certificate expiration surprises pages; monitor Certificate.ValidTo.
Named Credential is the only supported place to reference client cert — do not try to ship JKS in Apex.
CSR generation happens in Salesforce; private key never leaves.

Worked Examples (see `references/examples.md`)

Bank ACH partner — Daily batch callout
Expiry monitor — Prevent cert outage

Common Gotchas (see `references/gotchas.md`)

CSR generated externally — Private key material uploaded; weaker security.
Missing intermediate chain — Handshake fails.
No expiry alert — Outage Friday night.

Top LLM Anti-Patterns (full list in `references/llm-anti-patterns.md`)

Generating CSR externally
Missing intermediate chain
No expiry monitor

Official Sources Used

Apex REST & Callouts — https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts.htm
Named Credentials — https://help.salesforce.com/s/articleView?id=sf.named_credentials_about.htm
Connect REST API — https://developer.salesforce.com/docs/atlas.en-us.chatterapi.meta/chatterapi/
Private Connect — https://help.salesforce.com/s/articleView?id=sf.private_connect_overview.htm
Bulk API 2.0 — https://developer.salesforce.com/docs/atlas.en-us.api_asynch.meta/api_asynch/
Pub/Sub API — https://developer.salesforce.com/docs/platform/pub-sub-api/guide/intro.html

---name: mutual-tls-calloutsdescription: Configure mTLS for Apex callouts using Named Credentials with client certificate authentication. NOT for standard TLS or API key auth — use architect/integration-security-architecture.---# Mutual TLS CalloutsMutual TLS requires both sides to present certificates. Salesforce supports mTLS callouts via a client certificate stored in Setup → Certificate and Key Management, referenced from a Named Credential. This skill sets up the cert, the Named Credential, and a minimal Apex caller that proves the connection before shipping.## Adoption SignalsPartner APIs that mandate mTLS (banks, healthcare EDI, some government systems).## Recommended Workflow1. Generate a client keypair (or receive partner-signed cert) and import via Setup → Certificate and Key Management.2. Create Named Credential referencing the certificate; set endpoint + authentication protocol 'Per User' or 'Named Principal'.3. Write a small Apex probe: `HttpRequest req; req.setEndpoint('callout:MyPartner/health'); new Http().send(req);` and assert 200.4. Schedule a daily probe job with alerting; cert expiry surfaces 30+ days ahead.5. Rotate certificate annually or per partner policy.## Key Considerations- Self-signed certs are fine for dev but production requires partner-signed.- `Certificate expiration` surprises pages; monitor `Certificate.ValidTo`.- Named Credential is the only supported place to reference client cert — do not try to ship JKS in Apex.- CSR generation happens in Salesforce; private key never leaves.## Worked Examples (see `references/examples.md`)- *Bank ACH partner* — Daily batch callout- *Expiry monitor* — Prevent cert outage## Common Gotchas (see `references/gotchas.md`)- **CSR generated externally** — Private key material uploaded; weaker security.- **Missing intermediate chain** — Handshake fails.- **No expiry alert** — Outage Friday night.## Top LLM Anti-Patterns (full list in `references/llm-anti-patterns.md`)- Generating CSR externally- Missing intermediate chain- No expiry monitor## Official Sources Used- Apex REST & Callouts — https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts.htm- Named Credentials — https://help.salesforce.com/s/articleView?id=sf.named_credentials_about.htm- Connect REST API — https://developer.salesforce.com/docs/atlas.en-us.chatterapi.meta/chatterapi/- Private Connect — https://help.salesforce.com/s/articleView?id=sf.private_connect_overview.htm- Bulk API 2.0 — https://developer.salesforce.com/docs/atlas.en-us.api_asynch.meta/api_asynch/- Pub/Sub API — https://developer.salesforce.com/docs/platform/pub-sub-api/guide/intro.html

Frequently asked questions