Certificate-based user authentication
Key Takeaway
Certificate-based authentication logs a user in with a unique PEM-encoded X.509 certificate after Salesforce and the user's browser prove their identity to each other.
Certificate-based authentication lets Salesforce users log in with a unique digital certificate, a PEM-encoded X.509 certificate, instead of a username and password. The login uses Mutual Transport Layer Security (mTLS), so Salesforce and the user's browser each prove their identity to the other before the user is logged in. Certificate-based authentication complies with FedRAMP High Authenticator Assurance Level (AAL) 3 digital identity requirements and with personal identification verification cards.
How the login works
Here is what happens in the mTLS handshake when a user logs in with a certificate:
- The user goes to the My Domain login page and clicks "Certificate-Based Login".
- Salesforce sends its server certificate and certificate chain to the user's browser.
- The browser verifies the server certificate and chain.
- The browser sends the user's certificate, also called a client certificate, and its chain.
- Salesforce verifies the user's certificate and chain against the user authentication certificate configured in the org.
- The user is logged in only after both sides have authenticated each other.
The user must be able to connect to port 8443, because certificate-based authentication operates off Salesforce port 8443.