VIP AuthHub- How to add multiple certificate for oauthTokenCertificateAlias.

Products

• VIP Authentication Hub

Issue/Introduction

How to add multiple certificate for  oauthTokenCertificateAlias? 

Use case as follows:

- Currently oauthTokenCertificateAlias is linked to a Cert Alias pointing to Root CA certificate which is used within the SSL handshake connections and to trust the server cert.

- The Root CA Certificate will be replaced by a new one

- looking for the steps on how to import the new cert and link it to the oauthTokenCertificateAlias so both the old and new Root CA certs used for the SSL handshake to ensure that SSL will not fail once the server side switch to the new certificate. 

Environment

AuthHub 3.3.x and onward 

Resolution

Certificate rotation was introduced within 3.3.x AuthHub release and can be used as follows 

https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/vip-authentication-hub/3-3/Using/Management-APIs/CertificateManagement/certificate-rotation.html

1) oauthTokenCertificateAlias only accept one Certificate Alias 

2) the /admin/v1/certs can be used to import the new Root CA cert using the SAME Alias 

In this way you will end up having 2  Root CA certs the old and the new one under the same Alias 

3) The oauthTokenCertificateAlias should be pointed to the Alias in question 

Upon Handshake, AuthHub will go through the certs under the same Alias one by one, the cert which is successful in SSL validation will be used and the others will be ignored.