How to remove a certificate from a truststore?

[#1]

Our application uses client certificates for authentication. Various partners will provide us certificates for upload to our Apigee truststore.

Currently in test we have uploaded an incorrect certificate for one of our partners. We would not only like to add a new certificate for this customer, but remove the old one.

As far as I can tell there is no API for removing a certificate from a truststore, just for removing the truststore altogether. Not being able to manage certificates within a truststore will be a significant problem for us. Is there some API we can use for this purpose?

[gaurav_bhandari · Accepted solution]

Hi @pblair,

The API CALl that you have mention is correct. But I would suggest that execute GET API CALL first and then verify the certs that you want to delete and then execute the DELETE API CALL

1) GET API CALL

curl -u {user} "https://

<MS Server VIP NAME>/v1/o/{org}/environments/{env}/keystores/{truststore}/certs/{cert}"

2) DELETE API CALL

curl -u {user} -X DELETE https://<MS Server VIP NAME>/v1/o/{org}/environments/{env}/keystores/{truststore}/certs/{cert}

Also, instead of <MS Server VIP NAME>, you can execute the command on MS and use localhost:8080

Plus, after certificate addition/deletion. One must restart GATEWAY servers ie RMP server.You can restart either of the server or both depending upon the use case.

Please let me know in case you need more information.

Thanks and Regards,

Gaurav Bhandari

[#3]

I got this from support. To delete certs from a TrustStore:

curl -u {user} -X DELETE "https://api.enterprise.apigee.com/v1/o/{org}/environments/{env}/keystores/{truststore}/certs/{cert}"

[gaurav_bhandari · Accepted solution]

Hi @pblair,

The API CALl that you have mention is correct. But I would suggest that execute GET API CALL first and then verify the certs that you want to delete and then execute the DELETE API CALL

1) GET API CALL

curl -u {user} "https://

<MS Server VIP NAME>/v1/o/{org}/environments/{env}/keystores/{truststore}/certs/{cert}"

2) DELETE API CALL

curl -u {user} -X DELETE https://<MS Server VIP NAME>/v1/o/{org}/environments/{env}/keystores/{truststore}/certs/{cert}

Also, instead of <MS Server VIP NAME>, you can execute the command on MS and use localhost:8080

Plus, after certificate addition/deletion. One must restart GATEWAY servers ie RMP server.You can restart either of the server or both depending upon the use case.

Please let me know in case you need more information.

Thanks and Regards,

Gaurav Bhandari

[sgilson · Accepted solution]

I have added this method to the Apigee API reference here:

http://docs.apigee.com/management/apis/delete/organizations/%7Borg_name%7D/environments/%7Benv_name%...

Stephen

[jonesfloyd]

Thanks for adding that, Stephen!