This documentation is for WSO2 API Manager 2.1.0 View documentation for the latest release.
Dynamic SSL Certificate Installation - API Manager 2.1.0 - WSO2 Documentation

All docs This doc
Provide Feedback
Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 7 Next »

If you have a backend with a signed certificate (or a certificate which is not signed by a CA) you need to import it to the client-truststore and restart the server. This feature enables you to upload the backend certificate through API Publisher while creating or editing your API. Follow the steps below to add a new certificate to any endpoint.

WUM Update

Prerequisites

  1. Ensure that you have downloaded the latest WUM update. For more details, see Updating WSO2 Products in the WSO2 Administration Guide.
  2. If you are an existing user, follow the instructions given below. 
    1. Run the scripts inside the <APIM_WUM_UPDATED_PACK>/dbscripts/apimgt directory, according to your preferred database. For instructions on configuring databases, see Set up the database. Verify that the table AM_CERTIFICATE_METADATA has been created in your database.

    2. Open the <APIM_HOME>/repository/conf/axis2/axis2.xml file. Add the following code under the PassThroughHTTPSSLSender parameter.

      <transportSender name="https" class="org.apache.synapse.transport.passthru.PassThroughHttpSSLSender">
      	...
            <!-- ============================================== -->
            <!-- Configuration for Dynamic SSL Profile loading. -->
            <!-- Configured for 5 mins. -->
            <!-- ============================================== -->
            <parameter name="dynamicSSLProfilesConfig">
                    <filePath>repository/resources/security/sslprofiles.xml</filePath>
                    <fileReadInterval>600000</fileReadInterval>
            </parameter>
      </transportSender>
    3. If you use a different Trust Store/ Keystore configuration in the axis2.xml or carbon.xml files ,modify the KeyStore and TrustStore location in <APIM_WUM_UPDATED_PACK>/repository/resources/security/sslprofiles.xml file accordingly. The sslprofiles.xml file is configured with the existing client-truststore.jks

This feature currently supports only the the following formats for keystores and certificates.

  • Keystore : .jks
  • Certificate : .crt

If you need to use a certificate in any other format, you can convert it using a standard tool before uploading.


Adding a certificate

  1. Log in to the API Publisher. Create a new API or edit an existing API.
  2. Go to the Implement tab. Click Manage Certificates and click Add New Certificate
  3. Enter the following information and click Upload.

    NameDescription
    AliasEnter a name for your certificate.
    EndpointSelect an endpoint from the dropdown list
    CertificateEnter the location of your certificate file or click Browse to select through the UI
  4. The uploaded certificate aliases will be displayed.
  5. You can repeat from step 2 to add a certificate to the sandbox endpoint.

You add only one certificate per endpoint. Make sure that your certificates have not expired.

Deleting a certificate

To delete a certificate, click the icon adjacent to the certificate, as shown below.


  • No labels