RemoteCache Tactical Assertion does not work with TLS-enabled Redis

Products

• CA API Gateway

Issue/Introduction

We are trying to connect to a Redis cache server using the RemoteCache Tactical Assertion. Redis authentication has been configured to allow a "password only" auth.

When TLS is enabled in Redis, we get the following error:

"Unable to store cached value: Could not get a resource from the pool.  Exception caught!"

The same setup works if we disable TLS, but this is not allowed in production by customer's security policy

According to this KB, TLS is just a flag to enable in the Remote Cache configuration UI

We have tried the following:

Import server certificate as trust anchor
Set the "io.httpsHostAllowWildcard" cluster-wide to true
Regenerate server certificate to match hostname, using customer's CA
Used a self-signed certificate 

But still the issue was not resolved 

Environment

11.0

Resolution

Add the Redis certificate to the JVM “cacerts” file. In addition to the below settings .

io.httpsHostVerify CWP is set to false
io.httpsHostAllowWildcard is set to true

and if you implement this , then the problem should not persist.

Another approach you can try is that you enable both the intermediate certificate and the root certificate, and see if that solves .

io.httpsHostVerify CWP is set to true
io.httpsHostAllowWildcard is set to false