Resolve API Failures and Unknown Assertion Errors after Gateway 11.2 Upgrade
search cancel

Resolve API Failures and Unknown Assertion Errors after Gateway 11.2 Upgrade

book

Article ID: 442669

calendar_today

Updated On:

Products

CA API Gateway

Issue/Introduction

After upgrading the Layer7 API Gateway from version 11.1 to 11.2, customers may experience total service impact with the following symptoms:

  • API calls fail with a 500 Internal Server Error or Assertion not available message.
  • Gateway logs show: Assertion not available: Unknown assertion: EvaluateJsonPathExpression.
  • Encryption/Decryption policies fail with errors related to SsgKeyStoreManager being null.
  • Errors in the Policy Manager when opening Asymmetric Key Encryption/Decryption assertions.

Environment

  • Product: Layer7 API Gateway
  • Version: 11.2

Cause

There are two primary drivers for these errors in version 11.2:

  1. Deprecation of JSON Path V1: The Evaluate JSON Path Expression (V1) assertion was officially removed in Gateway 11.2 and replaced by version V2. Any policy still referencing the legacy V1 assertion will fail to load, resulting in the "Unknown assertion" error.
  2. Java 17 Compatibility: Gateway 11.2 runs on Java 17. Older versions of custom or asymmetric key assertions may not be compatible with the updated runtime or security manager, leading to null pointer exceptions when accessing the KeyStore.

Resolution

Step 1: Migrate to Evaluate JSON Path Expression V2

  1. Open each identified policy in the Policy Manager.
  2. Locate the failed Evaluate JSON Path Expression (V1) assertion.
  3. Replace it with the Evaluate JSON Path Expression V2 assertion.
  4. Important: Review the logic. V2 handles null values and empty arrays differently than V1. Refer to the  for details.

Step 2: Update Asymmetric Key Assertions

If you are seeing encryption errors, you must update the assertion module:

  1. Contact Broadcom Support and obtain the compatible AsymmetricKeyEncryptionDecryptionAssertion-1.0.9.saar (or newer) for Gateway 11.2.
  2. Upload the new module via the Policy Manager (Manage Server Modules).
  3. If using a containerized Gateway, place the .aar file in /opt/SecureSpan/Gateway/runtime/modules/assertions and ensure correct ownership/permissions.
  4. Restart the Gateway service.
Powered by Wolken Software