Error in setting up GMU mutual authentication

[Vivek Luhadiya]

Dear team,

Need urgent help from my fellow community members for the issue given below. I am trying to setup GMU in our company and i did all the steps as mentioned in this link.
https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/layer7-api-management/api-gateway/9-3/gateway-migration/configure-gmu-and-gateways-for-migration.html

The steps i did are as follows which is exactly same as mentioned in above link.
1) Published the REST management service on both source and target gateway.
2) I created a migration admin user with name 'DevMigrationAdmin' through policy manager and gave it Adminstrator role in source gateway. Similarly i created a migration admn user with name 'UatMigrationAdmin' through policy manager and gave it administrator role in target gateway.
3) Then i created a private key with CN same exactly same as Migration admin user i.e. 'DevMigrationAdmin' and exported the key and certificate from source gateway and gave it name DevCert.pem and DevKey.p12. I did similar steps on target gateway and generated UatCert.pem and UatKey.p12.
4) Then i mapped the both source and target gateway migrati admin user with the certificate created in step 3 by following the exact same steps mentioned in CA post.
5) Then comes the last step of establishing server trust between source gateway, target gateway and GMU, so i followed the steps as mentioned in post and generated the certificate of default ssl key and exported it with name 'DevSsl.pem'. I did the same steps in UAT and generated the certificate with name 'UatSsl.pem'.
6) Then to add the certificate in JDK trust store i ran the below command which is as per given in the documentation post i.e. 
keytool -importcert -alias DevMigrationAdmin -file "C:/Program Files/Java/jre7/bin/DevCert.pem" -keystore "C:/Program Files/Java/jre7/lib/security/cacerts" -storepass changeit

7) It gave the message the certificate is added in the store then i did the same step for UatCert.pem or target gateway with success.
8) Then i rant the command for migrateOut which is as follows:
./GatewayMigrationUtility.bat migrateOut --host 192.168.163.40 --dest dest.xml --folderName /APIs/Inbound/MigrationTest --clientCert DevKey.p12 --encryptionPassphrase @file:Encrypt.txt but it gave me below error.

Running...
Execution failed. Reason: No subject alternative names present. To resolve, either:
• Establish server trust and try again (more info: search "establish server trust" in the Gateway documentation), OR
• Re-run command with the "--trustHostname" parameter to bypass trust requirement.

I followed the steps mentioned in CA post for establishing server trust but still getting this error please help me out. I need the solution ASAP.

Thanks for the cooperation and support.

Regards
Vivek

------------------------------
Regards
Vivek
------------------------------

[Jay MacDonald]

Did you try running with --trustHostname parameter? Without it you must use the same value for --host parameter as is in the CN of the subject for the server certificate. So either use:

./GatewayMigrationUtility.bat migrateOut --host <ssg.example.com> --dest dest.xml --folderName /APIs/Inbound/MigrationTest --clientCert DevKey.p12 --encryptionPassphrase @file:Encrypt.txt

where <ssg.example.com> is the exact same as the CN value of the server's certificate, OR

./GatewayMigrationUtility.bat migrateOut --host 192.168.163.40 --dest dest.xml --folderName /APIs/Inbound/MigrationTest --clientCert DevKey.p12 --encryptionPassphrase @file:Encrypt.txt --trustHostname

which will bypass the hostname check.



------------------------------
Jay MacDonald - Adoption Architect - Broadcom API Management (Layer 7)
------------------------------

[Jay MacDonald]

Another point that is not very clear in the documentation is that the username in the Internal Identity Provider MUST match the CN of the client certificate's subject. So, for example, given my pkcs12 keystore file jaymac.p12, I run the following (where the password to unlock the keystore is in Password.txt):

jay@jaymac-laptop:~/SecureSpan/GMU-1.5.00$ openssl pkcs12 -in jaymac.p12 -nokeys -passin file:Password.txt
Bag Attributes
friendlyName: jaymac
localKeyID: 54 69 6D 65 20 31 35 39 31 39 30 35 39 36 30 31 38 31
subject=C = CA, ST = BC, L = Vancouver, O = Broadcom, CN = Jay MacDonald

issuer=C = CA, ST = BC, L = Vancouver, O = Broadcom, CN = Jay MacDonald

-----BEGIN CERTIFICATE-----
MIIDUTCCAjmgAwIBAgIEbmTcqzANBgkqhkiG9w0BAQsFADBZMQswCQYDVQQGEwJD
QTELMAkGA1UECBMCQkMxEjAQBgNVBAcTCVZhbmNvdXZlcjERMA8GA1UEChMIQnJv
YWRjb20xFjAUBgNVBAMTDUpheSBNYWNEb25hbGQwHhcNMjAwNjExMjAwNjAwWhcN
MjEwNjA2MjAwNjAwWjBZMQswCQYDVQQGEwJDQTELMAkGA1UECBMCQkMxEjAQBgNV
BAcTCVZhbmNvdXZlcjERMA8GA1UEChMIQnJvYWRjb20xFjAUBgNVBAMTDUpheSBN
YWNEb25hbGQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDe137uGLOD
chnxyVndamWjpugfG7285KwSN4sNLjKF5TzV0jgXvCWzcsgVbSXBMEsu0NofxK++
PQk943Qbc57/u+wa5cL1JfjGJJF0bJPguC2r4XaD4WQAGSY0COsr0jV8jJ/9bdmt
YgCYDUVZjFq/z8hhGxD/MGPY1FGzNjPNProHADND/W8jQZA5RMhBGPlS0xGNu2sw
bR5NlVhymxWtoE/tljPDqONQhdP1aA2g+hwFu9GSxIma3adb3pfjfEUyzzRxKiU0
ymlspkeY+zhd0agbd/jteWyuEULIXPzGUg6Aek/AplLtXBSmCHv+mQHWpI+zM8Jq
fh4GnB1GGTzNAgMBAAGjITAfMB0GA1UdDgQWBBRLXvXgrqwu55x0P8LcoZiWo0aE
rzANBgkqhkiG9w0BAQsFAAOCAQEA2WuWo6EUorbHlucIfA3lNEjI6ZHFEsdqQIY2
m7xcc3yAmfYfHQZXfsvw1pfuOpP4h/p9T4AjuJVsqnzX20eyaAUVLSBqAXAUUiFh
Gtju7f2jggyrff/mEyJYWxp3QAZehfniBBNbQR7pSNeIbl4X83TPzkumdNqY51u/
9qydhjrlkC4qkSBw24JvERIalMLx9SVdfm5WDl3KHzxTIkEPLiI3iXnxLN6MNqd9
dErGkDH1sG/f5kJRK6F79DY8Knewgc73XGcm6hDG50fTP68fP89chAwM+sIc7KIh
IqX6cE8UGCTqVeMF/Va0buyEuiYMtxYmoR+eFV+UqOFft0gCNA==
-----END CERTIFICATE-----
jay@jaymac-laptop:~/SecureSpan/GMU-1.5.00$

The CN for the subject is 'Jay MacDonald' - with a space. For this certificate to work with the Internal Identity Provider, the username MUST therefor also be 'Jay MacDonald' - with a space. Here is a screenshot of my IIP list to show you what I mean.

Note that the "Jay MacDonald" user has also been added to the administrator role. Now when I run the GMU with the following command, where the passphrase to unlock the pkcs12 key is encoded in EncodedPassword.txt (and which will also be used to encrypt the secrets in the output XML file), it works:

jay@jaymac-laptop:~/SecureSpan/GMU-1.5.00$ ./GatewayMigrationUtility.sh migrateOut --host ssg94.l7tech.com --dest dest.xml --folderName /Demos --clientCert jaymac.p12 -x @file:EncodedPassword.txt --encryptionPassphrase @file:EncodedPassword.txt
Running................
Done
jay@jaymac-laptop:~/SecureSpan/GMU-1.5.00$

------------------------------
Jay MacDonald - Adoption Architect - Broadcom API Management (Layer 7)
------------------------------

[Vivek Luhadiya]

Dear Jay,

Thanks for replying to my issue.
First thing is my Migration admin user name in Identity provider is 'DevMigrationAdmin' and CN name in my certificate is also 'DevMigrationAdmin' which is same as you mentioned above.

Second thing is if i run my command as below then it works
./GatewayMigrationUtility.sh migrateOut --host 192.168.163.40 --dest dest.xml --folderName /ADCB/APIs/Inbound/MigrationTest --clientCert DevKey.p12 --encryptionPassphrase @file:Encrypt.txt --trustHostname
Warning: TLS hostname verification has been disabled
Running...........................................
Done

but the issue is this Warning which is coming in execution which says 'TLS hostname verification has been disabled'. I don't want it after running the command because it confuse the Azure pipeline during CI/CD integeration and shows the job task as unsuccessful. Another thing if in place of --host 192.168.163.40 i write devmag02.adcb.com then it won't run and says reason as below
./GatewayMigrationUtility.sh migrateOut --host devmag02.adcb.com --dest dest.xml --folderName /ADCB/APIs/Inbound/MigrationTest --clientCert DevSslKey.p12 --encryptionPassphrase @file:Encrypt.txt --trustHostname
Warning: TLS hostname verification has been disabled
Running...
Execution failed. Reason: devmag02.adcb.com

Because of this i cannot run migrateOut command with my hostname as devmag02.adcb.com and i have to run with IP.
Please suggest some way to run it without warning and through mutual authentication only.


------------------------------
Vivek
------------------------------

[Deactivated User]

Try these two option
--trustCertficate  --trustHostname

------------------------------
Pre-Sales Consultant
CA Southern Africa
------------------------------

[Jay MacDonald]

What is the value of the CN in the Gateway certificate's subject?

------------------------------
Jay MacDonald - Adoption Architect - Broadcom API Management (Layer 7)
------------------------------