Error Creating New Key Store in API Management for 2 Way SSL

[GreggHinkle]

Hi,

I am trying to create a new new Key Store in API Management to be used for 2 way SSL. My security partner created a certificate and private key which we will use with a API Provider. Our provider required us to create our public certificate with the following criteria:

• Certificate should be in .cer or .crt format, which must be a X509 cert.

Our security partner created a certificate in *.crt format and the private key in .key format. From investigating these files, they appear to be in PEM format since the certificate starts with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE----- and the private key starts with -----BEGIN PRIVATE KEY----- and ends with -----END PRIVATE KEY-----.

I read the following blog https://blogs.sap.com/2018/01/19/sap-cloud-platform-api-management-client-certificate-authentication... and looked at OSS note 2796067 and it appears that SAP API Management requires the certificate and key in .pem format. From what I read, I should be able to rename the public certificate and private key to .pem since .pem, .crt, and .key are all PEM format.

I renamed the certficate to .pem and the private key to be .pem and created the .jar file as the blog stated. When I try to create a new key store in SAP API Management and upload the .jar file to it, I get the following error:

Does anyone have an idea why I keep getting this error?

[vinayak_adkoli]

Hi Gregg,

I don't see any errors in the steps that you've described. Where I believe the problem lies is in the format of the private key.

What has worked for me is getting the private key in PKCS#8 format that starts with either -----BEGIN ENCRYPTED PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY----- format.

You may be using PKCS#5 format. Just a guess, pls see if this helps.

Also, you may use this command to generate a p12 certificate from the X.509 certificate and the key you already have :

openssl pkcs12 -export -out keyStore.p12 -inkey myKey.pem -in certs.pem