I am struggling trying to get a SSL messages via an Apache reverse proxy from salesforce.com. I am getting 403 (forbidden) error when they attempt to send a message to us. I have verified the proxy is working by requesting the WSDL from the back end web service via a web browser and without the SSL authentication, it works from IE/FireFox/etc. If I turn off the SSLRequire completely, SFDC does not report an error, and deletes the message. Unfortunately, no messages are sent to my apache server. I get no logs, no message.
I believe that I want to use the directive SSLRequire to determine who the sender of the SSL message is.
SSLRequire (%{SSL_CLIENT_S_DN_CN} eq "proxy.salesforce.com")
Salesforce.com provided me with their public key, as the CN is in fact proxy.salesforce.com:
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
0c:9e:22:84:5f:b8:55:8c:cb:c5:bf:aa:01:2a:7b:23
Signature Algorithm: sha1WithRSAEncryption
Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 International Server CA - G3
Validity
Not Before: Dec 7 00:00:00 2011 GMT
Not After : Dec 7 23:59:59 2013 GMT
Subject: C=US, ST=California, L=San Francisco, O=Salesforce.com, Inc., OU=Application, CN=proxy.salesforce.com
Subject Public Key Info:
My SSL Request log shows:
[11/Jun/2013:07:50:28 -0400] 96.43.148.8 - TLSv1 RC4-MD5 "POST HTTP/1.1" 416
My errorlog: 96.43.148.8 - - [11/Jun/2013:07:50:28 -0400] "POST HTTP/1.1" 403 416 "-" "Jakarta Commons-HttpClient/3.1"
and my access log shows:
[Tue Jun 11 07:50:28 2013] [info] Access to /opt/apache/htdocs/dev denied for 96.43.148.8 (requirement expression not fulfilled)
[Tue Jun 11 07:50:28 2013] [info] Failed expression: (%{SSL_CLIENT_S_DN_CN} eq "proxy.salesforce.com")
[Tue Jun 11 07:50:28 2013] [error] [client 96.43.148.8] access to /opt/apache/htdocs/dev failed, reason: SSL requirement expression not fulfilled (see SSL logfile for more details)
The only things SFDC can tell me at this point, is (403)Forbidden
My config files:
<VirtualHost *:8010>
# Set up logging
LogLevel info
ErrorLog veri/sfdc.error.log
Customlog veri/sfdc.log combined
CustomLog veri/ssl_request_log "%t %h %{SSL_CLIENT_S_DN_CN}c %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
# misc directives
ServerSignature on
# Enable SSL on front end
SSLEngine On
SSLCertificateFile veri/server.crt
SSLCertificateKeyFile veri/server.key
SSLCertificateChainFile veri/intermediate.crt
SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-EXP
SSLOptions -FakeBasicAuth +StdEnvVars
<location />
Order deny,allow
deny from all
allow from 96.43.148.8
SSLRequire (%{SSL_CLIENT_S_DN_CN} eq "proxy.salesforce.com")
</location>
SetEnv USING_SSL_SERVER 1
ProxyRequests off
ProxyVia On
ProxyPreserveHost On
SSLProxyEngine off
ProxyPass <SNIPPED>
ProxyPassReverse <SNIPPED>
</VirtualHost>