At my company, I have to support a rather old application that does not support TLS 1.x. This application sends request to Salesforce, which is in the cloud (outside the company's secure perimeter). To do that, the application sends the request to a corporate proxy that then sends it to the cloud.

The problem now is that Salesforce will be deactivating SSL3 (which this application uses) and will be requiring this application to connect to it via TLS 1.1.

The only way I can think of sorting this out is putting a forward proxy in front of this application, change the request header to add it to be TLS based, and then it will take the request, forward it do the corporate proxy, that then sends to Salesforce.

So this is the configured VirualHost:

<VirtualHost _default_:12086>
# Put access log messages in a separate location
ErrorLog logs/FWDPROXY_UAT_SF_error_log

# Now configure the reverse proxy part
<IfModule mod_proxy.c>

# Enable forward proxy requests
ProxyRequests On

# Allows reverse proxying to https locations.
SSLProxyEngine On

RequestHeader set Front-End-Https "On"
ProxyPreserveHost On

# Allow requests from selected hosts or domains
<Proxy *>
Order Allow,Deny
Allow from all

<Location />
        Order allow,deny
        Allow from all

ProxyVia On

# This is the main proxy configuration
ProxyPass /
ProxyPassReverse /


</VirtualHost> is the corporate proxy. When testing this, the error I get is:

[Wed Feb 01 13:58:39 2017] [debug] mod_proxy_connect.c(122): proxy: CONNECT: connecting test.salesforce.com:443 to test.salesforce.com:443
[Wed Feb 01 13:58:39 2017] [error] [client] proxy: DNS lookup failure for: test.salesforce.com returned by test.salesforce.com:443

It seems that my forward proxy is trying to resolve the salesforce hostname, while I simply want it to forward it to the corporate proxy.

Any recommendations? Thank you.

  • I noticed that the forward proxy is trying to connect to "test.salesforce.com:443" but actually the SOAP URL is "test.salesforce.com" So it's adding the 443 there... What can I do? – Felipe Caldas Feb 1 '17 at 6:41

enter image description here

  1. Change delivery url of partner in your application and sets it to apache server (ex. http://your_apacheserver:8000/receive)
  2. apache server version is 2.4.25, modify httpd-ssl.conf likes below

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.