TLS connection with backend/target system in Apigee X.

[Anand-kumar2]

Do we need to restart Message Processor in Apigee X after setting up 1way/2way SSL Connection to reflect the changes?

As we don't have option to restart MP in ApigeeX then how to do it. Suggest please.

[dchiesa1]

No

---

@Anand-kumar2 wrote:

Do we need to restart Message Processor in Apigee X

---

Apigee X is a managed service, you don't have access to "message processors". In any case "restart" is not necessary. Just follow the documentation for setting up TLS. 

[Anand-kumar2]

Appreciate  @dchiesa1 for your quick response!

We are using 2way SSL to connect Backend/Target server from Apigee X in Eval account. For this we have generated "self signed certificate" and put it in our Keystore(cert & key in .pem format) and shared the same with Backend/Target system. We received CA Certificate from Target system that we stored in our TrustStore(only cert in .pem format) in Apigee.

On the other hand, Target system also stored our self signed certificate in their TrustStore.

After that we have put below codes in our Apigee Proxy Targetendpoint section:
<HTTPTargetConnection>
<Properties/>
<SSLInfo>
<Enabled>true</Enabled>
<ClientAuthEnabled>true</ClientAuthEnabled>
<KeyStore>ref://apigeeKeystoreRef</KeyStore>
<KeyAlias>apigeeselfsign</KeyAlias>
<TrustStore>ref://TargetTruststoreRef</TrustStore>
<IgnoreValidationErrors>true</IgnoreValidationErrors>
</SSLInfo>
<URL>https://mytargetserver.xxx.in</URL>
</HTTPTargetConnection>

But we are getting 500 Internal Server Error as below:

{
"httpCode": "500",
"httpMessage": "Internal error",
"moreInformation": "Source Certificate Missing or Expired"
}

Here we can see request reaches to Backend without cert.

Please help to resolve this issue.

FYI: In our self signed certificate, we are using CN = <myhostname.xxx.in> and
We can see CA Certificate shared by Target contains their hostname as CN = <mytargetserver.xxx.in>.

We will be happy if we can connect on Google meet to get your expert advice.