Defined TLS keystore in Apigee X under environment tab,alias but not working when hitting API proxy.

[priyashikhar]

Hi All,

Using APIGEE X, I have created TLS key store where uploaded certificates and created reference accordingly. Defined key store value and alias value in target servers point as well.

When I am hitting Api proxy URL via browser ,still facing SSL certificate issue.

Please guide me.

[dchiesa1]

When I am hitting Api proxy URL via browser ,still facing SSL certificate issue.

Before anyone here can give you specific help, you will need to be much more specific about

• what you've configured in the Apigee X side (Environment Group, TLS settings, etc). What cert did you use? What is the CN on that certificate? What is the root CA? What is the signing chain for that certificate? Did you upload the certs for the full signing chain?
• The specific issue you are seeing on the client side. Keep in mind that if the root CA that signed the cert you use on the Apigee X side is.... not widely known.. then the browser-side truststore ("CA certs" ) may not trust the cert.

But, you may be able to help yourself, in diagnosing what's going on. For example, you can use openssl to retrieve and verify the certificate chain of a remote site, including an API endpoint managed by Apigee. I suggest you try this tool out, to diagnose what's happening. Rather than just connect to the endpoint via browser, connect with openssl and observe what you see with those results.

Also keep in mind that usually the entry point for an API endpoint managed by Apigee X is a Cloud Load Balancer. Either an Internal Load Balancer (ILB) if your clients are connecting from an internal network, or an External Load Balancer (sometimes called XLB) if your clients are connecting from the public network. That is where TLS is terminated, in an Apigee X configuration. More detail on that here.