Access Gateway uses ESP to communicate with Identity Server. The Service Provider Certificates page allows you to view the private keys, certificate authority (CA) certificates, and certificate containers associated with this module. These keystores do not contain the certificates that Access Gateway uses for SSL connections to browsers or to back-end web servers.
To view or modify these certificates:
Click Devices > Access Gateways > Edit > Service Provider Certificates.
Configure the following details:
Signing: The signing certificate keystore. Click this link to access the keystore and replace the signing certificate as necessary. The signing certificate is used to sign the logout requests from ESP to Identity Server.
Trusted Roots: The trusted root certificate container for the CA certificates associated with Access Gateway. Click this link to access the trust store, where you can add trusted roots to the container.
ESP must trust the certificate of Identity Server that Access Gateway has been configured to trust. The public certificate of the CA that generated Identity Server certificate must be in this trust store. If you configured Identity Server to use a certificate generated by a CA other than the Access Manager CA, you must add the public certificate of this CA to the Trusted Roots store. To import this certificate, click Trusted Roots, then in the Trusted Roots section, click Auto-Import From Server. Specify the IP address or DNS name of your Identity Server and its port, then click OK.
You can also auto import Identity Server certificate by selecting the Auto-Import Identity Server Configuration Trusted Root option on the Reverse Proxies / Authentication page (click Devices > Access Gateways > Edit > Reverse Proxies / Authentication). With this option, you do not need to specify the IP address and port of Identity Server.
To save your changes to browser cache, click OK.
To apply your changes, click the Access Gateways link and click Update > OK.