Use a certificate to connect to a Gateway using Policy Manager

Products

• CA API Gateway

Issue/Introduction

The original ticket opened by a customer stated the following:

Using the Private Key Management, I created a new key with the defaults.
I then exported the key.

I then import the key into the policy manager.

When connecting, I am getting "Invalid Client Certificate" Error.

So, what am I missing?

In this KB, an example is given as a guide.

Environment

Release : 9.4, 11.1

Component : API GTW ENTERPRISE MANAGER

Resolution

Using client certificate from gateway to access Policy Manager Steps 

Part 1. Use Gateway to create a certificate, assign it to a user in an Identity Provider, and export it as a p12 file

1. Create a private key 

• Access policy manager with default ID password 
• Task -> Certificate, Keys and Secrets -> Manager Private Keys 
• Click Create Alias pmtest Subject DN: pmtest 

2. Create User in the default Identity Provider using the Subject DN from step 1

• Click Identity Providers 
• Right click Internal Identity Provider -> Create User 
• User name: pmtest (MUST BE THE SAME AS CERT) 

 3, Define roles and import certificate for the new admin 

• Right click Internal Identity Provider -> Search Identity Provider 
• Search for the new user pmtest when found double click user 
• Click Roles tab -> Add, check Administrator, click Add Click 
• Certificate tab -> Click Import 
• Since the certificate was created on GW click Import from “Private Key’s Certificate Chain” 
• From the Drop down select the new key ‘pmtest’ in Software DB 

4. Export the private key for import into Policy manager 

• Task -> Certificate, Keys and Secrets -> Manager Private Keys 
• Select the new key Alias pmtest -> Properties 
• Click ‘Export Key” - provide password for export 
• Provide a location for the p12 certificate 

Part 2 Import the p12 certificate to the Policy Manager and use it to connect

5. Import key into Policy manager 

• Disconnect from Policy Manager if connected
• Click "Connect" to bring up Login screen
• On the Login screen of a Policy Manager
• Check “Client Certificate” -> Click Manage 
• Certificate List - Import certificate… click Import 
• Pick the desired p12 file and click on Load
• Enter the p12 password and click OK

Part 3 Use a Certificate to login to the Policy Manager

6. Login the Policy Manager with the new user created (pmtest) using the certificate

• At the login screen, Check “Client Certificate” -> select the desired certificate (CN=pmtest) from the Certificate dropdown
• Select the desired Gateway from the Gateway dropdown and click OK