DLP API Detection fails after upgrade to version 16.1

Products

• Data Loss Prevention API Detection for Developer Apps Virtual Appliance

Issue/Introduction

Post-migration from DLP API Appliance 16.0 to DLP API Detection Server 16.1, the new server has stopped functioning. Detection is currently failing, and the REST client cannot connect or send traffic to the API Detection Server.

Environment

DLP 16.1 API Detection server

Cause

The issue is typically caused by certificate trust mismatch as the 16.1 upgrade requires renewed trust/handshake between the REST client and the API Detection Server.

Resolution

Step 1: Re-establish Certificate Trust:
1. Generate Certificate: On the Enforce server, use the `keytool` utility to generate a new self-signed certificate for the API detector.
   Command Example: keytool -genkey -keyalg RSA -alias my_selfsigned_cert -dname "CN=[API_Detection_Server_IP]" -keystore my_keystore.pkcs12 -validity 3650 -keysize 2048 -storepass [password] -keypass [password] -deststoretype pkcs12
2. Upload to Enforce: Navigate to System > Servers and Detectors > Overview, select the API Detection Server, and click Configure. Upload the new `.pkcs12` keystore and enter the password.
3. Reboot API Detection: Reboot the API Detection server to apply the new configuration.
4. Update REST Client: Export the certificate from the keystore using below command:
keytool -export -alias my_selfsigned_cert -file server.pfx -keystore my_keystore.pkcs12
5.  Import Certificate on REST Client: Transfer the certificate exported in Step 4 to the REST client machine and import it into the Trusted Root Certification Authorities store.


Step 2: Validate with Postman
To verify the API Detection server is receiving traffic, following this article to test with Postman.