Configure and Enable Mutual TLS Authentication (2024)

Mutual TLS is a mutual authentication method that encrypts the traffic between the client and the server by authenticating each other using their public-private key pair.

InCisco AppDynamics Controller, you can enable Mutual TLS to authenticate the Controller with third-party applications such as Slack, PagerDuty, and ServiceNow. This mutual authentication verifies that the alerts (HTTP request actions) sent to the third-party applications are from Cisco AppDynamics and not from a malicious entity.

Configuring mutual TLS authentication involves the following steps:

1. Generate a Certificate Signing Request (CSR) for your TLS certificate
2. Get the CSR signed from a Certificate Authority and upload the signed TLS certificate
3. Enable mutual TLS authentication in HTTP request actions

To configure mutual TLS authentication, you need to first generate a certificate signing request (CSR) to get your TLS certificate:

1. In theController Tenant UI, click Alert & Respond > Mutual TLS Configuration.
2. Click + New Certificate Signing Request (CSR).
3. Enter the following details:
1. Organization (Optional). The legal name of your organization.
2. Department (Optional). The name of your department handling the certificate.
3. Country. Select the country where your organization is located. By default, the country selected is the United States. Note that this field is mandatory and can’t be left blank.
4. State (Optional). The name of the state where your organization is located.
5. City (Optional). The name of the city where your organization is located.
4. Click Generate CSR.
5. Click Download CSR to download the .csr file. Note that you can also copy the content and save as a .csr file.

When you generate a CSR, Cisco AppDynamics creates a public- private key pair. The public key is available with the CSR and the private key resides with Cisco AppDynamicsin a secure key store.

After downloading the CSR file, you must get it signed from a certificate authority (CA) of your choice. You can then upload the signed TLS certificate. Cisco AppDynamicsController also supports certificate chain. A certificate chain consists of a leaf certificate and intermediate certificates.

To upload the signed TLS certificate on your Cisco AppDynamicsController:

1. ClickUpload New Client Certificate.

2. Upload the signed TLS certificate (.pemfile) directly or copy and upload the Base64 encoded text from the TLS certificate.

   

   If you have a certificate chain, upload only the leaf and intermediate certificates as a single.pemfile. Or copy and upload the Base64 encoded text of the the leaf and intermediate certificates. Do not upload the root certificate.

The following sample illustrates a certificate chain that consists of a leaf certificate and an intermediate certificate:

Points to consider:

Before uploading a new TLS certificate, ensure the following points are met:

• The certificate must be either in the .pem or .crt format.
• The certificate encoding scheme must be Base64.
• The certificate must have a valid expiry date.
• The certificate must be a client certificate.
• The certificate must match with the corresponding CSR.
• For a certificate chain,:
  • all the certificates must be uploaded by using a single.pemfile.
  • the first certificate must be the leaf certificate and the subsequent certificates must be the intermediate certificates. Each certificate must be signed by the subsequent certificate.
  • the leaf certificate must be a client certificate.
  • the leaf certificate must have a valid expiry date.
  • the leaf certificate must match the corresponding CSR.
  • the length of the certificate chain must not be greater than the length specified in the flagappdynamics.controller.alerting.mtls.max.certificate.chain.length. See Controller Setting for Certificate Chain Length.

If you face any error while uploading the signed TLS certificate, refer Troubleshoot Mutual TLS Certificate Issues.

Click Alert & Respond > Mutual TLS Configuration to view the uploaded TLS certificate. You can also click Download Certificateto download the .pem file.

If you have generated a CSR that is not yet used, you can view and download the unused CSR.

After uploading the TLS certificate, you can enable the mutual TLS authentication for HTTP request actions. Cisco AppDynamics fetches the TLS certificate and attaches it with the HTTP request actions (alerts). On third-party endpoints that are configured to receive alerts from Cisco AppDynamics, the certificate helps to verify that the alerts are from Cisco AppDynamics.

To enable the mutual TLS authentication:

1. Click Alert & Respond > HTTP Request Templates.
2. Do one of the following:
   • Select an existing template for which you want to enable mutual TLS and click Edit.
   • Click the + New icon to create a template. See Create or Modify an HTTP Request Template.

3. In the Authentication section, select the Also Turn on Mutual TLS option.

   

   This option is enabled only if you have uploaded a TLS certificate.

4. Click Save.

The Cisco Accounts team can specify the maximum length of the certificate chain.

To change the length of the certificate chain:

1. Log in to the Controller administration console using the root user password.

   http://<controller host>:<port>/controller/admin.jsp

2. SelectController Settings.
3. Locate the flagappdynamics.controller.alerting.mtls.max.certificate.chain.lengthand update its value. The default value is 2.
4. ClickSave.