2way TLS with p12 in truststore

Google Cloud Apigee
1

We have a P12 provided by target service owner which needs to be presented for a successful 2 way TLS handshake. I see TLS handshake fails when API proxy communicates with target service (via target server) when the same P12 truststore (cert and key pair) is referenced in both keystore and truststore. However, the same works when the cert is exported from P12 and references in truststore.

Did any one experience this behavior and can throw some light on this behavior?

Doesn’t Work:

{ “host” : “Host.com”, “isEnabled” : true, “name” : “TS_2WayTLS”, “port” : 443, “sSLInfo” : { “enabled” : “true”, “ignoreValidationErrors” : false, “clientAuthEnabled” : “true”, “keyAlias” : “P12Alias”, “keyStore” : “ref://P12storeRef”, “trustStore” : “ref://P12storeRef” } }

Works:

{ “host” : “Host.com”, “isEnabled” : true, “name” : “TS_2WayTLS”, “port” : 443, “sSLInfo” : { “enabled” : “true”, “ignoreValidationErrors” : false, “clientAuthEnabled” : “true”, “keyAlias” : “P12Alias”, “keyStore” : “ref://P12storeRef”, “trustStore” : “ref://P12CertRef” } }

Thanks, Ram

2

GREAT, I’m glad you found a solution. Thanks for your experience. Surely this will help others, too.

Dealing with the various formats of TLS keys and certs can be tricky. I myself prefer to use the .PEM formats for everything; I find them easier to handle, examine, and so on.