A Qualys SSL Scan is a security test that evaluates the strength and compliance of your solution’s SSL/TLS configuration. SSL/TLS protocols encrypt data transmitted between servers and clients, ensuring secure communication. Salesforce requires this scan for any external or non-Salesforce endpoints your solution connects to during the security review process.
The Salesforce Security Review Team will use the Qualys SSL Scanner to check your endpoints. To pass the security review, your endpoints must receive an ‘A’ grade for SSL/TLS compliance. If your endpoints score below an ‘A’, your submission will be rejected. You can run the scan yourself by entering your endpoint’s base URL into the Qualys SSL Scanner web form and submitting it. Providing the scan results with your submission is optional, but ensuring an ‘A’ grade beforehand helps avoid security review delays.
