Layer7 API Management

Hello,

I'm working on routing outbound to an endpoint under SSL in a pre-production environment.  My callouts are failing because of certificate issues.

"Certificate not verified. Caused by: Certificate path validation and/or revocation checking failed"

I thought I saw somewhere the use of useDefaultTrustAnchor.  Is this still a valid cluster wide property?  I can't find it in the list of properties (8.2).

This is for a pre-production environment. I'd hate to have to manage certs on the gateway for outbound routing purposes.

Any help is appreciated!

Thanks,

Alejandro

Hi Alejandro,

you can set pkix.useDefaultTrustAnchor=true for well-know trust anchors.

kind regards

Heiko

Hi,

Thanks.  Is there anything else that I need to do to enable this?  I don't see the property in the drop down list, but I added it manually.  Even after adding the property, I don't see the behavior that I expect. I still receive:

Problem routing to https://<host>/api/v1/<resource>. Error msg: Unable to obtain HTTP response from https://<host>/api/v1/<resource>: Certificate not verified. Caused by: Certificate path validation and/or revocation checking failed

A couple of questions here...  Which keystore is being used?  I find several:

./opt/SecureSpan/JDK/jre/lib/security/cacerts

./opt/CA/sdk/install_config_jre/lib/security/cacerts

./etc/pki/java/cacerts

./etc/pki/ca-trust/extracted/java/cacerts

Is the default password documented anywhere?  I'd like to list the certs in the keystore to verify.  It's possible that the certificate isn't in the store and I'm making an assumption.

Thanks,

Alejandro

You need to add the cert for https://<host> in your Task / Manage Certificates. You can simply Add a new cert in there via URL. The gateway needs to "trust" all of the connections it makes via https and that "trust" store is the Task / Manage Certificates

The gateway doesn't use any of those keystores. You need to make it available using the manage certificates capability: https://wiki.ca.com/display/GATEWAY83/Manage+Certificates

Got it.  Thanks!

Alejandro