WSO2 APIM - SSL certificate

2
votes

Using WSO2 APIM 2.6.0 seems the primary keystore certificate is used for multiple purposes

  • service (nio-https) SSL - that can be easily changed
  • signing a JWT token to the API Gateway backend service
  • thrift SSL endpoint for the Traffic Manager (port 9711)

The issue I have is that in a distributed setup a separate gateway should reach the TM endpoint and the hostname needs to be trusted. So - in theory I can create a self-signed certificate with a new hostname, however a new keypair/certificate will break existing backend validating the JWT token.

In theory I may just create a different self-signed certificate with the same public key, it may be more complex to manage in long run (I don't want to promote this practice).

Question: Is there a way to configure either the JWT signing certificate or the thrift SSL certificate separately? Or disable hostname validation for the throttling service (port 9711)?

(I'm not sure we want to allow disabling the hostname validation globally)

1
wso2wso2-am

1 Answers

0
votes

Since you have a distributed setup, this can be achieved easily.

You need to change the certificate in the gateways so that they use that keystore for the TM connection.

Keep the KM keystore as it is so that JWT is signed using the same old keystore.