API Gateway Private Key Renewal with Same Alias

Products

• CA API Gateway

Issue/Introduction

API Gateway uses private keys in the keystore for signing messages, SSL/TLS communication, and JWT generation. When a certificate associated with a private key is nearing expiry, it must be renewed. This article provides the procedure to renew the private key while maintaining the existing alias name to avoid reconfiguring policies that reference that specific alias.

Environment

• Product: API Gateway
• Releases: 10.x, 11.x

Cause

This is a "How To" article for a maintenance procedure; no technical fault is associated with this request.

Resolution

To renew a private key and maintain the same alias without disrupting policy references, follow these steps:

1. Preparation

   • Take a snapshot or backup of the Gateway database and relevant nodes.
   • Ensure you have the new private key and its complete certificate chain ready for import.

2. Replacement Procedure

   • Open the Policy Manager and navigate to Tasks > Certificates, Keys, and Secrets > Manage Private Keys.
   • Select the expiring private key and click Delete. (Note: Policies will not be permanently broken as long as the key is replaced with the same alias before the next service invocation or cache refresh).
   • Click Import and upload the new private key file.
   • Assign the exact same alias name as the previous key.

3. Cluster Synchronization (Mandatory)

   • If the Gateway is part of a cluster, the changes are written to the database but may not be immediately recognized by the running memory of all nodes.
   • Restart the Gateway service on all cluster nodes to ensure the new certificate is recognized: # service ssg restart