how to configure Apigee to bypass the check of CN/SAN on the certificate for the backend/target?

[ysharat]

Hi there,

From APIGEE am connecting to a backed over SSL channel, unfortunately, the backend hostname which am connecting from apigee in the target endpoint server doesn't match with certificate CN or SAN of that backend cert, how can we bypass the host check? Note: I didn't configure any trust store or keystore for this to trust the cert of the backend. Pls advice how to by pass this host/CN check?

[API-Evangelist]

Did you check below documentation?

https://docs.apigee.com/api-platform/system-administration/options-configuring-tls

[ysharat]

I saw it. Could not find any leads to disable backend host verification.In Other gateways for example CA API Gw, there was an option to disable/enable host verfication. But i couldn't find here. Pls advice.

The below was cited under the element IgnoreValidationErrors from the following link.

https://docs.apigee.com/api-platform/system-administration/options-configuring-tls

 When used with a target endpoint/target server, if the backend system uses SNI and returns a cert with a subject Distinguished Name (DN) that does not match the hostname, there is no way to ignore the error and the connection fails.

[API-Evangelist]

Did you enable the option & test? What specific error you are seeing while testing? Can you provide specific error details?

[ysharat]

which option are you referring to here, could you pls put the snipped here precisely how to apply that option at the target endpoint?

[ysharat]

close this thread if there is no workaround for it. Thanks

[API-Evangelist]

My apology I missed to respond. Please try the option which @dchiesa1 recommended & I messaged you with little more insights &  it will help if you go step by step while troubleshooting..we can get into a call to troubleshoot if required or you may open support case.

We should able to resolve it together.

Found some reference related to CommonName at  at https://cloud.google.com/apigee/docs/reference/apis/apigee/rest/v1/organizations.environments.target...

[dchiesa1]

Using the CommonName element you can tell the system to validate a different CN or SAN. Apigee will still use the specified TrustStore to validate the peer certificate and will always check validity (expiry and not-before) for the presented certificate, unless you specify the IgnoreValidationErrors element.

...
        <SSLInfo>
          <Enabled>true</Enabled>
          <CommonName wildcardMatch="false">host.myexample.com</CommonName>
          <TrustStore>ref://myTrustStoreRef</TrustStore>
        </SSLInfo>
        <URL>https://b8500.mysite.com</URL>

[ysharat]

Thanks. Tried all the options still didn't work because it complains CN doesn't match with the backend host in san/cert ssl fail.Thats fine.thanks again to get back on this one.

[himanshuai]

Tried the options, it does not work. Have you tested this ?

[dchiesa1]

Maybe you could explain what you want to accomplish, and what you configured, and what you are observing, and what you mean specifically by "it does not work." 

?