Replace Certificate Chain Fails with Deserialization Error in API Gateway 11.2.1

Products

• CA API Gateway

Issue/Introduction

When attempting to replace a certificate chain for a private key in Layer7 API Gateway version 11.2.1, the Policy Manager may disconnect or throw an error upon clicking "Finish". The process successfully reads the PEM file, but fails during the final commit.

The following error is observed in the Gateway logs: WARNING 901 com.l7tech.gateway.common.spring.remoting.http.SecureHttpInvokerServiceExporter: Attempt to deserialize non-whitelisted class 'com.l7tech.security.xml.SignerInfo'

The Policy Manager logs show: WARNING: Exception during remote API call: org.springframework.remoting.RemoteInvocationFailureException: Invocation of method [public abstract java.util.List com.l7tech.gateway.common.security.TrustedCertAdmin.findImpactedKeysByUpdateKeyEntry...] failed

Environment

• Layer7 API Gateway 11.2.1 (Appliance)
• Policy Manager (Windows/Linux)

Cause

This issue is identified as a product defect where the Policy Manager fails to properly deserialize the SignerInfo class during the certificate chain replacement process in version 11.2.1.

Resolution

To resolve this add the following line to the  /opt/SecureSpan/Gateway/node/default/etc/conf/system.properties file 

com.l7tech.server.DeserializeSafe.allowClasses=com.l7tech.security.xml.SignerInfo

and restart the ssg service .

The issue does not occur when using PM2 which could be used as a alternative.

https://techdocs.broadcom.com/us/en/ca-enterprise-software/layer7-api-management/api-gateway/11-2/learning-center/overview-of-the-new-policy-manager/getting-started.html

Targeted to be fixed in the next gateway version 11.2.2 .