2 Way TLS Setup between API Proxy and Backend Target failing to send Client Certificate

[#1]

I've setup an API Proxy to my backend target, loaded a client certificate in a keystore, created a KeyStoreRef and deployed the setup as per the guide

http://docs.apigee.com/api-services/content/configuring-ssl-edge-backend-service#configuringtwowaytl...

When running a test I get error 503, and looking at the logs in my target backend device, I can see the connection but it is not supplying the client certificate. Anyone have any ideas if I missed anything please?

[cmbrown]

is the backend using a self signed cert ? If so you need to also create a truststore.

[#3]

Both the server cert at the back end and the client cert I'm trying to send are EnTrust certs, so should not need a trust store.

[#4]

Hi,

I am currently working on an similar issue. I will post back here my findings.

regards,

[#5]

Thanks Russell, I believe from looking at my audit logs it's my issue you're looking at. 🙂

[anilsr]

@Russell Blewitt , Answers are strictly for answers. Please use comments for feedback / queries etc. Converting it to comment. Thank you.

[#7 · Accepted solution]

Hi,

Place the full CA chain into the keystore that is going to be used in the client side response. So

the keystore contains - client cert - intermediate cert(s) - root CA certificate

That should resolve the issue.

[#8]

It worked a treat Russell. Thanks for all the help.