This documentation is for WSO2 API Manager 1.9.0. View documentation for the latest release.
Skip to end of metadata
Go to start of metadata

After you install the APIM, it is recommended to change the default security settings according to the requirements of your production environment. As the APIM is built on top of the WSO2 Carbon platform, some security configurations are inherited from WSO2 Carbon.

The following topics explain the WSO2 Carbon platform-based, and product-specific configurations: 

WSO2 Carbon platform-based security configurations

The following security configurations are common to all WSO2 products that are built on top of the WSO2 Carbon platform.

Configuring transport-level security

WSO2 products support a variety of transports that make them capable of receiving and sending messages over a multitude of transport and application-level protocols. By default, all WSO2 products come with the HTTP transport. The transport receiver implementation of the HTTP transport is available in Carbon. The transport sender implementation comes from the Tomcat HTTP connector, which is configured in the <APIM_HOME>/repository/conf/tomcat/catalina-server.xml file.

For more information on securing the HTTP transport, see Configuring transport level security in the WSO2 Carbon documentation.

Configuring keystores

A keystore is a repository that stores artifacts such as cryptographic keys and certificates. These artifacts are used for encrypting sensitive information and establishing trust between your server and outside parties that connect to your server.

All WSO2 products come with a default keystore (wso2carbon.jks). In a production environment, it is recommended to replace it with one or more keystores.

See the following in the WSO2 Carbon documentation:

Securing sensitive passwords

As a secure vault implementation is available in all WSO2 products, you can encrypt the sensitive data such as passwords in configuration files using the Cipher tool.

See the following in the WSO2 Carbon documentation:

Also see how to encrypt secure endpoint passwords.

Enabling JAVA security managerSee Enabling JAVA security manager in the WSO2 Carbon documentation on how to prevent untrusted code from manipulating your system. 

APIM-specific security configurations

  • No labels