Adding client certificates

Client certificates are a crucial part of securing communication, particularly for mTLS authentication. They help verify the identity of a client (such as another server or application) when it connects to webMethods Integration over HTTPS.

Before you begin

An administrator can generate or replace certificates for all users. Normal users can generate only their own certificates.

About this task

In webMethods Integration, you can store the client certificates and associate a certificate with a user account. You can add client certificates for users on the Client Certificate page. When a user runs a flow service through the HTTP interface, or a REST API, or a SOAP API, the user authentication happens with the certificate.

With a tenant certificate, you can configure your organization-level certificate so that incoming traffic for execution can be authenticated against the tenant certificate. If a tenant certificate is configured along with a user certificate, then the user certificate validation takes precedence. The administrators can generate the tenant level certificates. Using the tenant certificate, you can run integrations for all users in that tenant.

Note: The JKS file format certificates are not supported in the Federal Information Processing Standards (FIPS) mode environments.

Here, the steps are explained to generate user certificates. You can follow the same steps to generate tenant certificates from the Tenant Certificate page. The Select User field is not applicable for tenant certificates.

Procedure

Select Settings > Client Certificate > User Certificate.
In the Select User field, select a user. Only active users are listed in the Select User field.
In the Select Certificate field, select Generate Private Key and Certificate if you want to generate a private key and a new webMethods Integration signed client certificate. webMethods Integration validates it against the issuer of the certificate.

If you want to upload a new certificate, select Upload New Certificate and click Browse File to upload a new client certificate signed by a trusted certificate authority (CA).
Click Generate and select a format in which the key must be generated.
If a valid certificate is configured, the certificate gets downloaded to your configured download location in your local system. The generated certificate is named as username.fileformat. The file format is based on the certificate format that is selected during certificate generation. For example, if you selected the jks format, the certificate is named as username.jks.
Also, the Certificate password dialog appears.
Copy the password and save it for future reference. You need this password to access the downloaded certificate.

Note: The password is not generated for the certificates that are generated in text format.
Click Dismiss after copying the certificate.
The certificate details are displayed.
Click Download to download the user certificate or click Delete to delete the user certificate.
The downloaded certificate file is named as username.crt. The certificate contains the private key and the client certificate.
Note:
- It is not a good practice to use the generated client certificate for any other purpose than intended.
- For tenant certificate, the downloaded file name is in the format tenantname.crt.

Results

You added client certificates. The files are keystore and truststore. The keystores hold the client’s private key and certificate (when webMethods Integration is the client). The truststore holds the public certificates of trusted parties (CAs or external servers).

What to do next

Regularly update certificates before they expire. You can use these certificates to run a flow service that requires mTLS. For more information, see Running flow services by using mTLS authentication.