Skip to content

IBM API Connect

Preview feature

This feature is available in Preview and isn't yet generally available (GA). Functionality and behavior can change before GA.

Renewing certificates that a gateway already serves

IBM API Connect doesn't let Certificate Manager - SaaS change which keystore a gateway's TLS server profile uses. To renew a certificate that a gateway serves for a hostname, Certificate Manager - SaaS updates the existing keystore in place. Provision to the installation that discovery created for that certificate, or enter the ID of the keystore that the TLS server profile already uses. If you leave the Keystore ID empty, Certificate Manager - SaaS creates a new keystore, and the gateway keeps serving the old certificate until you wire the new keystore to it in IBM API Connect.

  1. Click Installations > Machines.
  2. Click the more options more options button at the right end of the IBM API Connect machine's row, and then select Provision.

  3. In the Search a certificate by name, expiration or fingerprint field, begin typing the certificate name you want to provision. Click the certificate when you see it listed.

    Verify that you've selected the correct certificate by reviewing the Subject DN, Validity, and Fingerprint.

  4. Under Certificate Information, from the Certificate Home drop-down, select where the certificate lives in IBM API Connect:

    • Keystore - Installs the certificate, its chain, and its private key in a keystore. This is the default.
    • Consumer Application - Replaces the public certificate registered on a consumer application. The private key isn't sent.

  5. Depending on the certificate home you selected, enter the following:

    If you selected Keystore:

    • (Optional) In the Keystore ID field, enter the ID of an existing keystore to update. Leave it empty to create a new keystore. Later renewals update the same keystore.

    If you selected Consumer Application:

    • In the Catalog ID field, enter the UUID of the catalog in the provider organization.
    • In the Consumer Organization ID field, enter the UUID of the consumer organization.
    • In the Application ID field, enter the UUID of the consumer application whose public certificate you want to replace.

  6. Under Installation Details, from the Binding Type drop-down, select how the certificate is used:

    • Keystore Only - Stores the certificate without connecting it to a TLS profile. This is the default.
    • API Gateway (SNI) - Renews a certificate that a gateway service serves for a hostname, by updating its keystore in place. Use it with an existing Keystore ID.
    • Backend mTLS - Points a TLS client profile at the keystore, so outbound mutual TLS (mTLS) connections present the certificate.

    If you selected Backend mTLS, enter the TLS Client Profile ID. This is the UUID of the TLS client profile to update.

    Note

    If you selected Consumer Application as the certificate home, keep Keystore Only. A consumer application certificate has no TLS profile to update.

  7. If you don't want the certificate to be pushed when you save, turn off the Push certificate on save toggle.

  8. Click Save.

    Want to schedule your provisions?

    Schedule your provisions daily, weekly, or monthly. Learn more

After saving, Certificate Manager - SaaS pushes the certificate to IBM API Connect and creates an installation on the Installations tab:

  • Keystore: The certificate, chain, and private key are updated in the keystore you specified, or saved to a new keystore. For Backend mTLS, the TLS client profile is then updated to use the keystore. For API Gateway (SNI), the gateway serves the renewed certificate through its existing TLS server profile, with no gateway change.
  • Consumer Application: The application's public certificate is replaced with the new certificate and its chain.