Versions Compared

Old Version 15

changes.mady.by.user Former user

Saved on

compared with

New Version 16

changes.mady.by.user Former user

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Warning

This is available only as a  WUM update and is effective from 22nd October 2018 (2018-10-22). For more information on updating WSO2 API Manager, see Updating WSO2 API Manager.

...

  1. Create an API.
  2. Edit the API and navigate to the Manage tab.

  3. Select Mutual SSL under API Security.

    Note

    You can select both OAuth2 and Mutual SSL options. This means that the user can access the API using a valid OAuth2 token or using a valid client certificate. When OAuth2 and Mutual SSL are both enabled, Mutual SSL authentication will have a higher priority than OAuth2 as explained as follows:

    API SecurityUser's ResponseOutcome
    OAuth2Mutual SSL

    OAuth2
    token

    Mutual SSL
    Certificate

    EnabledEnabledSentSent
    • Initially, the Mutual SSL certificate is validated. If the validation is successful, the OAuth2 token is ignored.
    • If the Mutual SSL certificate fails, the OAuth2 token is validated, but if the OAuth2 token fails as well, the API call will fail.
    EnabledEnabledNot sentSent
    • The Mutual SSL certificate is validated. If the validation fails, the API call will fail.
    EnabledEnabledSentNot sent
    • The OAuth2 token is validated. If the validation fails, the API call will fail.

  4. Click Manage Certificates to upload a new client certificate. Select Add New Certificate.


    Insert excerpt
    Dynamic SSL Certificate Installation
    Dynamic SSL Certificate Installation
    nopaneltrue

    Info

    After configuring, the certificate will be added to the Gateway nodes which are defined under the Environments in api-manager.xml. In a clustered setup, as gateway configurations are identical, sync the <API-M_HOME>/repository/resources/security/listenerprofiles.xml and <API-M_HOME>/repository/resources/security/client-truststore.jks among the gateway nodes. After the configured interval, the synapse transport will be reloaded in all the gateway nodes.

  5. Provide an alias and public certificate. Select the tier that should be used to throttle out the calls using this particular client certificate and click Upload.
  6. Save and Publish the API

...

  • Application subscription is not permitted for APIs that are only protected with Mutual SSL. Hence, subscription/application level throttling is not applicable for these type of APIs.

  • Resource level throttling is not applicable for the APIs that are only protected with Mutual SSL.

  • Resource level security will not be applicable for the APIs that are only protected with Mutual SSL.

  • Scope level security will not be applicable for the APIs that are only protected with Mutual SSL.

...