How to Generate a CSR on Axway API Gateway

In this tutorial, you will learn how to generate a CSR for Axway API Gateway.

Generate the CSR code for Axway API Gateway

If you have already generated your CSR and received your certificate files, skip ahead to installing the SSL certificate on Axway API Gateway.

Axway API Gateway stores certificates and keys in Policy Studio, but Policy Studio cannot create a CSR itself. It can generate X.509 certificates and private keys, yet the signing request has to come from another tool. You have two practical options:

• The quickest way is to use our CSR Generator to create the CSR and private key in your browser.
• Alternatively, generate the CSR yourself with OpenSSL, as shown below.

Either way, you end up with two files: a .csr request that you submit to the CA, and a .key private key that you keep and later import into Policy Studio.

Step 1: Generate the CSR with OpenSSL

OpenSSL is preinstalled on most Linux distributions, so you can run the command on your API Gateway host or on any workstation that has OpenSSL. On Windows, install a build first (for example the Win32/Win64 OpenSSL installer, or use the openssl that ships with Git for Windows). Then run:

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr

Replace yourdomain with a label for your site. The file names are arbitrary: the domain that actually gets secured is the Common Name you type at the prompt. OpenSSL writes both files to your current directory.

OpenSSL then prompts for the details that go into your certificate. Complete them as follows:

• Country Name: the two-letter code for your country, for example US.
• State or Province Name: the full name of the state or region where your organization is registered, for example California.
• Locality Name: the city or town where your organization is registered, for example San Diego.
• Organization Name: your company’s legally registered name, for example Your Company LLC.
• Organizational Unit Name: this field is deprecated. Leave it blank.
• Common Name: the fully qualified domain name (FQDN) you want to secure, for example yoursite.com. For a wildcard certificate, use *.yoursite.com.
• Email Address: optional. Leave it blank.
• A challenge password: leave it blank.
• An optional company name: leave it blank.

To secure more than one hostname, add the names as a Subject Alternative Name (SAN) extension when you generate the request:

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr -addext "subjectAltName=DNS:yoursite.com,DNS:www.yoursite.com"

List every hostname the certificate should protect. For a single name you can skip the extra flag, because the CA adds the SAN from the domain on your order.

Step 2: Submit the CSR and keep the key

Open the .csr file in a plain text editor and copy its entire contents, including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines, into the CSR field during your certificate order. If you want to confirm the details before you order, paste it into our CSR Decoder to see the domain and organization the request encodes.

Keep the .key file private and back it up. Axway needs this exact key to use the certificate: if you lose it, the issued certificate is unusable and you have to start over with a new CSR.

After the Certificate Authority validates your order and delivers the certificate files, import the certificate and this private key into Policy Studio under Environment Configuration > Certificates and Keys > Certificates, add the CA chain, then assign the certificate to your HTTPS interface and deploy. Our guide on installing an SSL certificate on Axway API Gateway walks through the full import and deploy process.