Skip to content

Create a new IBM API Connect machine

Preview feature

This feature is available in Preview and isn't yet generally available (GA). Functionality and behavior can change before GA.

Creating a new machine is the initial step in enabling Certificate Manager - SaaS to connect directly to IBM API Connect for certificate management. Once you have created machines, you can move on to provisioning certificates to those machines.

Before you begin

  • IBM API Connect SaaS, or self-managed IBM API Connect version 10.0.x or later.
  • At least one active VSatellite that can reach the IBM API Connect management (platform) endpoint.
  • The UUID of the provider organization that you want to connect. Each machine connects to one provider organization.
  • The client ID and client secret from the API Manager toolkit credentials.
  • Credentials for your deployment type:
    • SaaS: A platform REST API key.
    • Self-managed: The username and password of a provider organization user, and the user registry realm that the user belongs to (for example, provider/default-idp-2).
  • Minimum required permissions: The account doesn't need environment-wide administrator access. It needs these permissions in the provider organization:
    • Read access to keystores, TLS profiles, gateway services, catalogs, and consumer applications, for discovery.
    • Write access to keystores, TLS client profiles, and consumer applications, for provisioning.

  1. From the Authentication Method drop-down, select how Certificate Manager - SaaS authenticates to IBM API Connect:

    • API Key (SaaS) - Uses a platform REST API key. This is the default.
    • Username and Password (Self-Managed) - Uses a provider organization user's username, password, and realm.

  2. Enter the Management Endpoint Hostname. This is the hostname or IP address of the IBM API Connect management (platform) endpoint.

    Note

    Enter only the hostname or IP address, without https:// or a path.

  3. Enter the Port. If you leave it empty, Certificate Manager - SaaS uses port 443.

  4. Enter the Provider Organization ID. This is the UUID of the provider organization that this machine connects to. Enter the UUID, not the organization name.

  5. Enter the Client ID from the API Manager toolkit credentials.

  6. Enter the Client Secret from the API Manager toolkit credentials.

  7. Enter your credentials based on the authentication method you selected:

    • If you selected API Key (SaaS), enter the API Key.
    • If you selected Username and Password (Self-Managed), enter the Username and Password of the provider organization user, and then enter the Realm (for example, provider/default-idp-2).

    Warning

    Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.

  8. Click Test Access, then click Continue. Note that Continue is only enabled if the Test Access is successful.

    Note

    Test Access signs in to IBM API Connect and reads the provider organization's keystores. It fails if the credentials, the Provider Organization ID, or the account's keystore read permission is wrong.

What discovery finds

When you run discovery on an IBM API Connect machine, Certificate Manager - SaaS finds the certificates that the provider organization uses for:

  • Gateway (SNI) hostnames: Certificates in keystores that a TLS server profile uses and that a gateway service serves for a hostname.
  • Backend mutual TLS (mTLS): Certificates in keystores that a TLS client profile uses for outbound connections.
  • Storage only: Certificates in keystores that no TLS profile uses.
  • Consumer applications: The public certificates registered on consumer applications in each catalog.

Discovery imports each certificate and its chain, but not its private key. To leave expired certificates out of the results, turn on Exclude Expired Certificates when you set up discovery.

What's next?

Refer back to Create a new machine to finish setting up your new machine by configuring Discovery and Provisioning scheduling.

For existing machines: