Skip to content

Create a new IBM DataPower Gateway machine

Creating a new machine is the initial step in enabling Certificate Manager - SaaS to connect directly to application keystores for certificate management. Once you have created machines, you can move on to provisioning certificates to those machines.

Before you begin

  • IP address or hostname of the IBM DataPower Gateway
  • REST Management Interface port (default: 5554)
  • Minimum required credentials on the DataPower Gateway: Choose between user credentials or shared credentials.
    • User credentials: The username and password you enter must have admin permissions.
    • Shared credentials: Optionally, you can use shared credentials from your credential provider (CyberArk is the only credential provider currently supported by Certificate Manager - SaaS). To use this option, first set up the connection to CyberArk.
  • Admin account with read/write access to gateway configuration and file storage for both discovery and provisioning operations
  • At least one active VSatellite connection
  • Supported versions: All current IBM DataPower Gateway versions including the Limited Edition container image

Certificate storage location

Certificates must be stored in application domain workspaces. The default domain is supported along with custom application domains.

  1. In the DataPower Hostname or IP Address field, enter the hostname or IP address of your IBM DataPower Gateway.

  2. If your DataPower Gateway uses a port other than 5554, enter the port number in the REST Management Port field.

  3. (Optional) From the Credential Type drop-down, select either Enter Credentials or Select Credentials. Only users with the enabled "CyberArk shared credential" capability will see this option.

    Important

    Your view of credentials may be limited due to your role. System Administrators and PKI Administrators should be able to select any credential, but users with the Resource Owner role are limited to only using the credentials associated with their teams.

    Note

    • Enter Credentials - Is used to enter your admin credentials manually.
    • Select Credentials - Is used to select your shared credentials from CyberArk.
    • If you choose Enter Credentials, enter your DataPower admin credentials in the Username and Password fields.
    • If you choose Select Credentials. From the Credential drop-down, select your shared credentials.

  4. From the Authentication Method drop-down, select either Username & Password or Client Certificate (mTLS).

    • If you select Username & Password, enter your DataPower admin credentials in the Username and Password fields.
    • If you select Client Certificate (mTLS), enter your PEM-encoded client certificate in the Client Certificate (PEM) field and your PEM-encoded private key in the Client Private Key (PEM) field.

    Warning

    Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.

  5. (Optional) If your DataPower Gateway uses a self-signed management certificate, disable the Verify TLS Certificate toggle.

    Note

    DataPower Gateways commonly use self-signed management certificates. The Verify TLS Certificate toggle defaults to enabled. Disable it when connecting to gateways that present self-signed or untrusted management certificates.

  6. Click Test Access, then click Continue. Note that Continue is only enabled if the Test Access is successful.

What's next?

Refer to back to Create a new machine to finish setting up your new machine by configuring Discovery and Provisioning scheduling.

For existing machines: