What is to best way to handle the .key and .cert in different environments

[karlapudiravi]

Hi All,

I am using .key and .cert files to communicate with the backend services, what is the best way to externalize the .key and .cert files[as the files are different in each environment]?

Regards,

Ravi.

[DChiesa]

Hi Ravi Kumar

Normally a key and cert is used for a HTTPTargetConnection; it is used in the SSLInfo section of the configuration. If this is the case, then you can use TargetServers to satisfy your needs. Read about that here.

But, if you need some data that is not specific to the HTTP connection to the backend, you can use the Key-Value Store. Within Apigee Edge, there is a Key-Value store that stores simple string values index by simple string keys. For example you can lookup "backend-url" and get "http://foo/bar/bam". The KVM allows you to store data that are specific to environments or backend systems. See the documentation here.

To use it,

1. create a KVM Store in each your environments like {dev, test, prod}. The KVM Store should have the same name for each environment, but each one will be different. You will probably want to create an encrypted KVM store.
2. Serialize the data you want to store, into a string. (For an RSA key and cert, you can serialize into PEM into base64 encoded format.) Store the strings for your data under keys like "target-key" and "target-cert" or whatever makes sense for you.
3. Embed in your API Proxy a KVM-Get policy that retrieves from the KVM store using the keys you used in step 2.
4. convert the strings into some usable form

In summary, for settings on target servers, you can use the TargetServer artifact. For other settings, you can use the KVM Store.