Troubleshooting mismatch of self-signed certificates - PingIntelligence for APIs

Page created: 12 May 2021 |

Page updated: 1 Nov 2021

| 1 min read

5.0 Capability API Security Advanced API Cybersecurity Linux On-Premises Operating System Hosting Environment PingIntelligence for APIs Product

If the ASE certificate is changed after the deployment of PingIntelligence policy and it doesn't match with the certificate present in the ase.pem certificate file, you might encounter SSL related issues.

To resolve these issues:

Undeploy the PingIntelligence policy by following either of the two options as applicable:
- Undeploy PingIntelligence policy for Flow Hook with self-signed certificate
- Undeploy PingIntelligence policy for Flow Call Out with self-signed certificate

To obtain the correct certificate to match what's in the ase.pem file, run the following command.

# openssl s_client -showcerts -connect <ASE IP address>:<port no> </dev/null 2>/dev/null | openssl x509 -outform PEM > ase.pem

Paste the correct certificate in the /opt/pingidentity/pi/apigee/certs/ase.pem file.
Redeploy the PingIntelligence policy by following either of the two options as applicable:
- Deploy PingIntelligence policy for Flow Hook with self-signed certificate
- Deploy PingIntelligence policy for Flow Call Out with self-signed certificate
Note:
Make sure that the ase_ssl parameter in /pingidentity/pi/apigee/config/apigee.properties file is set to true.