Oracle Cloud API Gateway¶

API Gateway certificates can't be changed after they're created, so every provisioning creates a new certificate resource in OCI. Before you provision, check that:

• The certificate has an RSA key of 2048 to 4096 bits, its full issuing chain, and hasn't expired. API Gateway doesn't accept other key types.
• The certificate covers every DNS name and IP address of the certificate that the API gateway serves now. Certificate Manager - SaaS refuses a certificate that would drop a name, because the switch would break TLS for clients that use it. A wildcard name such as *.example.com covers api.example.com, but not example.com or v1.api.example.com. If the current certificate has a wildcard name, the new certificate needs the same wildcard name.
• The API gateway is in the machine's compartment.
• The API gateway already serves a custom certificate, not Oracle's default certificate.
• The API gateway doesn't have a FULL resource lock.
• The API gateway hasn't failed and isn't being created or deleted. If it's being updated, Certificate Manager - SaaS waits for the update to finish.
• The region has a free API Gateway certificate slot. Certificate Manager - SaaS creates the new certificate before it deletes the old one. OCI limits the number of API Gateway certificates in each region, and a compartment quota can lower the limit. The default limit depends on your OCI payment method and can be low. If the region is at its limit, ask Oracle to raise it before you provision.

Use this procedure to provision a certificate from Certificate Manager - SaaS to an Oracle Cloud API Gateway machine.

1. Sign in to Certificate Manager - SaaS.

2. Click Installations > Machines.

3. Click the more options button at the right end of the Oracle Cloud API Gateway machine's row, and then select Provision.

4. In Search a certificate by name, expiration or fingerprint, search for and select the certificate you want to provision.

   Verify that you selected the correct certificate by reviewing the Subject DN, Validity, and Certificate SHA1 Fingerprint.

5. Leave Certificate OCID and API Gateway Name as they are. Both fields are read-only.

6. (Optional) Under Certificate Information, in Certificate Name, enter a display name for the certificate resource in Oracle Cloud. If you leave it empty, Certificate Manager - SaaS derives a name from the certificate, for example venafi-api.example.com-2027-01-15-0123abcd.

7. Under Installation Endpoint, in API Gateway OCID, enter the OCID of the API gateway that serves the certificate.

   Note

   To install the certificate in Oracle Cloud without attaching it to an API gateway, enter (unbound). No API gateway changes, and nothing is deleted. The certificate still uses a certificate slot. Each renewal of an (unbound) installation adds another unattached certificate and deletes none, so the certificates build up. Delete the ones you don't need in the Oracle Cloud Console.

8. To save without pushing the certificate, disable Push certificate on save.

9. Click Save.

   Tip

   You can schedule your provisions daily, weekly, or monthly. See Set up a machine provisioning schedule.

After you save, Certificate Manager - SaaS uploads the certificate, its chain, and its private key to Oracle Cloud as a new API Gateway certificate, and waits until it's active. It then switches the API gateway to the new certificate and waits until OCI confirms that the API gateway is active again. Only then does it delete the certificate that the API gateway served before. An installation appears on the Installations tab.

The installation's Certificate OCID is the OCID of the new certificate resource. Every renewal creates a new certificate resource, so the OCID changes each time. API Gateway Name is empty until the machine's next discovery fills it in with the API gateway's display name. Discovery also updates it when the API gateway is renamed in Oracle Cloud.