In this guide, you will learn how to install an SSL certificate on Axway API Gateway. If you have not applied for a certificate yet, the first part shows you how to generate a CSR code and submit it to the Certificate Authority.
Generate the CSR code for Axway API Gateway
Before a Certificate Authority can issue your certificate, you need a CSR (Certificate Signing Request). You have two options:
- The quickest way is to use our CSR Generator to create the CSR and private key automatically.
- Alternatively, generate the CSR yourself with the OpenSSL utility. Follow our step-by-step tutorial on how to generate a CSR in Ubuntu.
OpenSSL creates a .csr file and a .key file. Keep both safe. Open the .csr file with a plain text editor such as Notepad and copy its full contents, including the BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST lines, into the relevant box during your SSL order. Keep the .key file private: you will need it to install the certificate later.
Install an SSL certificate on Axway API Gateway
After you submit the CSR, the Certificate Authority validates your order and emails the certificate files, usually as a ZIP archive. Download and extract it on your computer. You should have your primary server certificate, one or more CA/intermediate certificates, and the private key you created with the CSR.
On Axway API Gateway you manage certificates with Policy Studio. The process has three parts: import the certificate and key into the certificate store, import the CA/intermediate so the chain is trusted, then assign the certificate to the HTTPS interface and deploy.
Step 1: Open the certificate store in Policy Studio
Launch Policy Studio and connect to your API Gateway instance. In the configuration tree on the left, expand Environment Configuration, then select Certificates and Keys > Certificates. This screen lists the X.509 certificates and keys trusted by the API Gateway.
Step 2: Import your certificate and private key
On the Certificates screen, click Create/Import. The Configure Certificate and Private Key dialog opens. Use the X.509 Certificate tab to load your server certificate:
- If your certificate and private key are in separate files, click Import Certificate and browse to your certificate file.
- If your certificate and private key are in the same file (for example a PKCS#12 .p12/.pfx bundle or a combined PEM file), click Import Certificate + Key and browse to that file instead.
Check that the format selector matches your file (commonly .pem, or .der for binary files). If you imported the certificate only, switch to the Private Key tab, click Import Private Key, and browse to your .key file. Enter the key password if the file is protected.
Design time vs run time: Policy Studio keeps two stores. The certificate you import here goes into the configuration that Policy Studio manages. When you deploy in Step 4, that configuration is pushed to the runtime store used by the live API Gateway, so the gateway can present the certificate to clients.
Step 3: Import the CA/intermediate certificate
Clients trust your certificate only when the full chain is present. Import every CA/intermediate certificate your Certificate Authority supplied into the same store. From the Certificates screen, click Create/Import again, then on the X.509 Certificate tab click Import Certificate and select each intermediate file. If your intermediates are delivered inside a Java keystore, use the Keystore button instead, then select the entries and click Import to Trusted certificate store.
Step 4: Assign the certificate to the HTTPS interface and deploy
Importing a certificate stores it, but the gateway will not serve it until you assign it to an HTTPS interface. In the Policy Studio tree, expand your API Gateway instance and open the Listeners node, then the HTTPS interface you want to secure (for example the API Manager interface on port 8075, or the API Gateway Manager interface on port 8090). Right-click the HTTPS interface and choose Edit. On the Network tab, click the X.509 Certificate button and select the certificate you imported.
Click OK to confirm, then click Deploy in the toolbar to push the updated configuration to the running API Gateway. After the deployment finishes, the gateway presents your certificate on that interface.
Once the deployment completes, run a quick test and check your new SSL certificate for errors and vulnerabilities. Our SSL Checker scans your installation and reports the chain, expiry, and protocol support in seconds.
Frequently Asked Questions
You install it in Policy Studio. Connect to your API Gateway instance and go to Environment Configuration > Certificates and Keys > Certificates. Import the certificate and key there, then assign the certificate to an HTTPS interface under the instance’s Listeners node and deploy.
Use Import Certificate when the certificate and the private key are in two separate files; you then import the key separately on the Private Key tab. Use Import Certificate + Key when both are bundled in one file, such as a PKCS#12 (.p12 or .pfx) file, so the gateway reads the certificate and key together.
Yes. Clients trust your certificate only when the full chain is available. Import every CA/intermediate certificate from your Certificate Authority into the same certificate store so Axway can send the complete chain during the TLS handshake. Missing intermediates are a common cause of trust errors.
Importing a certificate only stores it. The gateway serves it after you assign the certificate to an HTTPS interface (under the instance’s Listeners node, on the Network tab) and click Deploy. If you skip the assignment or the deployment, the interface keeps using its previous certificate.
Axway imports X.509 certificates in PEM and DER encoding, and combined certificate-and-key files in PKCS#12 (.p12 or .pfx). When importing, confirm the format selector in the dialog matches your file so the certificate and key load correctly.
Save 10% on SSL Certificates when ordering from SSL Dragon today!
Fast issuance, strong encryption, 99.99% browser trust, dedicated support, and 25-day money-back guarantee. Coupon code: SAVE10
