2 Way SSL - Client Certificate Not Sent To Server

Question

I'm have an application deployed to salesforce on the force.com platform, which I'm trying to configure a 2 way SSL for.

I.e. I want that for each request sent to from SF to my server, a client certificate will be sent.

I did the necessary configurations on SF for the certificate to be sent, but I'm still getting 403.7 from the server, which means: forbidden, client certificate required.

I installed wireshark on the server, captured traffic to see the 2 way ssl handshake, and I'm trying to find in the server hello message where it tells the client the trusted CAs from which a client certificate should correspond, but I'm having difficulties finding it. I suspect that's why the client does not send the certificate.

Can anyone point me to where in the server hello I should look? Or perhaps in another packet capture?

Thanks in advance.

Client Key Exchange record:

Answer 1

Here, the server sends its Certificate Request message and the client sends its Certificate message in response, but that message contains 0 certificates.

Typically, this happens when the client was unable to select a client certificate to use. Either it's not configured properly to make use of any certificate, or it can't find one that is issued by one of the acceptable CAs.

Look at the Certificate Request packet and check its certificate_authorities list. This is a list of the CA Distinguished Names (DNs) that the server is willing to accept.

One way or another, the client will need to find a client certificate with which it can build a chain towards of those DNs. In the simplest case, a client certificate issued by such a DN is available. Otherwise, the client could have to build a chain from a client cert to such a DN, it would need to have the necessary intermediate CA certificates to do so. (How this is done depends on the client's configuration mechanisms.)

If intermediate CA certificates are necessary and not available on the client side, you may need to configure your server to accept them and advertise them in the Certificate Request too.