Root Certificates

Products

• CA API Gateway

Issue/Introduction

We have Root certificate added to the Certificate Store to support some of our client apps. But when the certificate is rotated, routing fails and below is the error we receive. Only the child certificate is working. Most of the child certs are set to expire in a span of 6 months to 1 yr which a maintenance overhead. Roots certs have longer expiry date and we can avoid these problems. 

Not sure why Layer7 is not working well with root certs. Is there something we can look into?

 2021-05-01T13:18:18.806-0400 WARNING 71294384 com.l7tech.log.custom.auditLogs: -5: service_name="UserPreferenceService [/preferences*]" request_id="00000178af4c9f5a-81aa1fe" message_id="4042" message="Problem routing to https://SomeURL. Error msg: Unable to obtain HTTP response from https://someurl: java.security.cert.CertificateException: Server cert cn=*.aws.domain.com found but not trusted for SSL. Caused by: Server cert cn=*.aws.domain.com found but not trusted for SSL." audit_time="1619889498755" type="auditMessageDetail"

 

 

  

 

Environment

All supported versions of the CA API Gateway

Resolution

Remove all (child/intermediate) certificates that share this certificate in the chain. The gateway will only pick 1 first applicable certificate for handshake if there are all certificates in the store (intermediate/root) only import the highest certificate you wish to trust and remove the lower ones.

Alternately you can go into the route assertion in the policy.

Go to the Connection TAB. 

And choose the specific certificate that you want to trust instead of allowing all.

"Trust only the specified Trusted Certificates"

https://techdocs.broadcom.com/us/en/ca-enterprise-software/layer7-api-management/api-gateway/11-1/policy-assertions/assertion-palette/message-routing-assertions/route-via-http-s-assertion.html#concept.dita_049ffc6cf73f4e1b368ebb8707b00fe50b5546cc_ConfiguringtheConnectionTab

Item 6 on this page.