This documentation is for WSO2 API Manager 2.1.0. View documentation for the latest release.

All docs This doc

Versions Compared


  • This line was added.
  • This line was removed.
  • Formatting was changed.


  1. Ensure that you have downloaded the latest WUM update. For more details, see Updating WSO2 Products in the WSO2 Administration Guide.
  2. If you are an existing user, follow the instructions given below. 
    1. Run the scripts inside the <APIM_WUM_UPDATED_PACK>/dbscripts/apimgt directory, according to your preferred database (Alternatively, you can find the script to create only the AM_CERTIFICATE_METADATA  from the database script and run it ). For instructions on configuring databases, see Set up the database. Verify that the table AM_CERTIFICATE_METADATA has been created in your database.

    2. Open the <APIM_HOME>/repository/conf/axis2/axis2.xml file. Add the following code under the PassThroughHTTPSSLSender parameter.

      Code Block
      <transportSender name="https" class="org.apache.synapse.transport.passthru.PassThroughHttpSSLSender">
            <!-- ============================================== -->
            <!-- Configuration for Dynamic SSL Profile loading. -->
            <!-- Configured for 5 mins. -->
            <!-- ============================================== -->
            <parameter name="dynamicSSLProfilesConfig">

      The default time to apply the certificate is 10 minutes. You can configure this by changing the <fileReadInterval> parameter. Note that the time is given in milliseconds.

    3. If you use a different Trust Store/ Keystore configuration in the axis2.xml or carbon.xml files ,modify the KeyStore and TrustStore location in <APIM_WUM_UPDATED_PACK>/repository/resources/security/sslprofiles.xml file accordingly. The sslprofiles.xml file is configured with the existing client-truststore.jks


This feature currently supports only the the following formats for keystores and certificates.

  • Keystore : .jks
  • Certificate : .crt

If you need to use a certificate in any other format, you can convert it using a standard tool before uploading.


After configuring, the certificate will be added to the Gateway nodes which are defined under the Environments in api-manager.xml. In a clustered clustering setup, as gateway configurations are identical, sync the <APIM_HOME>/repository/resources/security/sslprofiles.xml file and the and <APIM_HOME>/repository/resources/security/client-truststore.jks should be synced between all the Gateway and Publisher jks among the gateway nodes. After the configured interval, the synapse transport will be reloaded in all the gateway nodes.

Adding a certificate

  1. Log in to the API Publisher. Create a new API or edit an existing API.
  2. Go to the Implement tab. Click Manage Certificates and click Add New Certificate
    Image RemovedImage Added
  3. Enter the following information and click Upload.

    AliasEnter a name for your certificate.
    EndpointSelect an endpoint from the dropdown list
    CertificateEnter the location of your certificate file or click Browse to select through the UI
  4. The uploaded certificate aliases will be displayed.
  5. You can repeat from step 2 to add a certificate to the sandbox endpoint.