webMethods.io API Gateway certificate based mutual authentication
Tags: webmethods, apigateway, api, integration
Published: 2023-04-13 09:52:22

---
title: webMethods.io API Gateway certificate based mutual authentication
published: true
date: 2023-03-29 09:22:36 UTC
tags: webmethods, apigateway, api, integration
canonical_url: https://tech.forums.softwareag.com/t/webmethods-io-api-gateway-certificate-based-mutual-authentication/276439
---

 

## Introduction

This article explains how requests can be authenticated using certificates while invoking the native request.

## Audience

It is assumed that readers of this article know how to set up API and configure policies on the API gateway.

## Pre-requisite

• Access to [webMethods.io](http://webMethods.io) Integration and [webMethods.io](http://webMethods.io) API Gateway

• Flow service exposed as API on [webMethods.io](http://webMethods.io) integration.

• Generate the certificates on [webMethods.io](http://webMethods.io) integration.

• Refer below link to create the flow service on [webMethods.io](http://webMethods.io) integration.  
[FlowServices - webMethods.io Integration](https://docs.webmethods.io/integration/developer_guide/flowservices/#gsc.tab=0)

• Refer below link to generate\configure the certificates on [webMethods.io](http://webMethods.io) Integration  
[Two-Way SSL - webMethods.io Integration](https://docs.webmethods.io/integration/data_access_and_security/clientcertificate/#gsc.tab=0)

• Refer below link to create the API on API Gateway  
[Create your first Rest API - webMethods.io API Gateway](https://docs.webmethods.io/apigateway/10.15.0/getting_started/chapter1a/#gsc.tab=0)

## Usecase

• In our case we have created a flow service on [webMethods.io](http://webMethods.io) Integration  
• This flow service is exposed as API on [webMethods.io](http://webMethods.io) integration  
• This flowservice endpoints are exposed and secured by the certificates.  
• To invoke this API, we need to pass the certificates for authentication.  
• In our case we are going to configure the native API endpoints on API Gateway.  
• When the request is sent from API Gateway to the native endpoints then the certificates will be sent along with the request.  
• These certificates will be configured on API Gateway.

[![image](https://global.discourse-cdn.com/techcommunity/optimized/3X/e/e/eef9c6aab4358d90838c0429ceca5f3e511fe4aa_2_690x238.png)](https://global.discourse-cdn.com/techcommunity/original/3X/e/e/eef9c6aab4358d90838c0429ceca5f3e511fe4aa.png "image")

## What is Mutual Authentication

• Mutual Authentication, also commonly referred to as Two-Way Authentication or Two-Way SSL.  
• It refers to the combination of both Server and Client Authentication.  
• In this mechanism the server is authenticating itself to the client, and the client is authenticating itself to the server in order to establish a secure encrypted channel between them

[![image](https://global.discourse-cdn.com/techcommunity/optimized/3X/5/7/578d4488d4189f42000844500d14949150353ccd_2_664x500.png)](https://global.discourse-cdn.com/techcommunity/original/3X/5/7/578d4488d4189f42000844500d14949150353ccd.png "image")

## Implementation

**Implementation done on [webMethods.io](http://webMethods.io) Integration**  
• Created a flow service.  
• Enabled the http endpoints on flow service.

[![image](https://global.discourse-cdn.com/techcommunity/optimized/3X/e/e/ee5ef1d88c70d03eb692dd694b438fb5477a2ec5_2_690x350.png)](https://global.discourse-cdn.com/techcommunity/original/3X/e/e/ee5ef1d88c70d03eb692dd694b438fb5477a2ec5.png "image")

• Generated the certificates from the platform in \*.jks format.

[![image](https://global.discourse-cdn.com/techcommunity/optimized/3X/b/a/baf6e8854b36cd9c7773f7a28a7217818f86d355_2_690x356.png)](https://global.discourse-cdn.com/techcommunity/original/3X/b/a/baf6e8854b36cd9c7773f7a28a7217818f86d355.png "image")

**Implementation done on [webMethods.io](http://webMethods.io) API Gateway**

- Create a custom keystore.
- Navigate to Administration an click on Security tab

[![image](https://global.discourse-cdn.com/techcommunity/optimized/3X/a/3/a3c28c77a6d60e4c48ed976123dba89b6808aecb_2_690x450.png)](https://global.discourse-cdn.com/techcommunity/original/3X/a/3/a3c28c77a6d60e4c48ed976123dba89b6808aecb.png "image")

• Created the alias for keystore

[![image](https://global.discourse-cdn.com/techcommunity/optimized/3X/3/1/3127d853c392e7606d219deb6e1373a297daa7f0_2_690x212.png)](https://global.discourse-cdn.com/techcommunity/original/3X/3/1/3127d853c392e7606d219deb6e1373a297daa7f0.png "image")

• Configure the API with policies.  
• In our case we have created the API named “SumAPI”  
• Configuration of traffic monitoring policy for logging the request and response.

[![image](https://global.discourse-cdn.com/techcommunity/optimized/3X/b/5/b53b350e93655563f3244a1909808cf43b02e198_2_690x301.png)](https://global.discourse-cdn.com/techcommunity/original/3X/b/5/b53b350e93655563f3244a1909808cf43b02e198.png "image")

• Configuration of routing policy with custom keystore and alias.

[![image](https://global.discourse-cdn.com/techcommunity/optimized/3X/4/5/45cc21bea7e50a03ae68292473093d5be24a240a_2_690x270.png)](https://global.discourse-cdn.com/techcommunity/original/3X/4/5/45cc21bea7e50a03ae68292473093d5be24a240a.png "image")

## Testing using postman client

**Failure scenario:** When custom keystore is not configured on the routing policy of API GW

[![image](https://global.discourse-cdn.com/techcommunity/optimized/3X/0/d/0d50c1ec978445884a2deb96c4b2430ec8ae7ebf_2_690x269.png)](https://global.discourse-cdn.com/techcommunity/original/3X/0/d/0d50c1ec978445884a2deb96c4b2430ec8ae7ebf.png "image")

[![image](https://global.discourse-cdn.com/techcommunity/optimized/3X/f/e/feb667f965c58621054be787fa2559271525fe04_2_690x445.png)](https://global.discourse-cdn.com/techcommunity/original/3X/f/e/feb667f965c58621054be787fa2559271525fe04.png "image")

**Successful scenario:** When custom keystore is configured on the routing policy of API GW

[![image](https://global.discourse-cdn.com/techcommunity/optimized/3X/5/f/5ffa4f3ca1db6a062f819d4afc650ad192d41b3a_2_690x279.png)](https://global.discourse-cdn.com/techcommunity/original/3X/5/f/5ffa4f3ca1db6a062f819d4afc650ad192d41b3a.png "image")

[![image](https://global.discourse-cdn.com/techcommunity/optimized/3X/1/f/1f0b9dcb0925ed6f5328bf22cd32c5c7216186f6_2_690x376.png)](https://global.discourse-cdn.com/techcommunity/original/3X/1/f/1f0b9dcb0925ed6f5328bf22cd32c5c7216186f6.png "image")


[Read full topic](https://tech.forums.softwareag.com/t/webmethods-io-api-gateway-certificate-based-mutual-authentication/276439)