SSL cert configuration in wso2 api manager

1
votes

I have the deployment pattern like below

Consumer APP (Browser)->API Manager API -> Backend ELB CNAME (XYZ.com) -> Backend ELB (SSLcert1-ABC.com) -> Back end Service (SSLcert1-ABC.com).

Backend service is created with a generic certificate (cert CN does not match the hostname or host IP). The same is imported into ELB. But, Backend ELB CNAME is different than CN of the backend service cert. Now, we have imported backend service cert into client-truststore of wso2 api manager. When we initiate a call from wso2 api manager to backend ELB with ABC.com, it complains domain!=certname of backend. Which is true. Also, we have enabled Hostnameverifier->AllowAll. We have modified the /etc/hosts file with an entry of ::1 ABC.com XYZ.com to indicate that both are same. But still not able to resolve the issue "requested domain!=certname of backend". Any clue how to solve this?

1
sslwso2wso2-am

1 Answers

0
votes

In APIM 2.0.0, it's required that the CN of the certificate you put into APIM's client-truststore be the same as the immediate client's hostname, which is the backend ELB in your case.