MustGather: SSL and certificates problems on IBM API Connect

Answer

The following information describes the documentation needed by IBM support to investigate the SSL and certificates issues:

1. Describe the issue
   1. Provide a detailed problem description which includes the error messages or unexpected results. Some screenshots might be very helpful to illustrate the errors or unexpected results.
   2. Provide some details regarding the configuration of the TLS profile and API (which is experiencing the issue). You can provide the following information, which might help us to get a clear understanding about the issue:
      • Screen shots of the TLS profile.
      • Is this a new configuration you are trying or it is an existing configuration which stopped working? If this is an existing configuration, is there anything recently changed before seeing the issue? If this is a new configuration, please make sure using the supported certificate format: P12 (PKCS12) that contain the private key, the public certificate from the Certificate Authority, and all intermediate certificates for the Present Certificate and P12 (PKCS12) or PEM for the Trust Store. Please see IBM Documentation for details: https://www.ibm.com/support/knowledgecenter/en/SSMNED_5.0.0/com.ibm.apic.cmc.doc/ssl.html and https://www.ibm.com/support/knowledgecenter/en/SSMNED_5.0.0/com.ibm.apic.apionprem.doc/task_apionprem_ssl.html
      • Which API or which policy in the API assemble is facing the issue?
      • Did you change any configuration in the DataPower's APIM domain? If yes, please let us know which configuration has been changed?
   3. Provide the firmware version you are using for APIC (CLI command output of "system show version") and DataPower (CLI command output of " show version").
2. Recreate the issue and and collect the following data
   1. Set log level:debug and enable packet capture from the DataPower (Please change these settings back to the original after recreate the issue and gather all the required data in the third item below "Download the data and submit to IBM Support for review"):
      WebGUI: Control Panel -> Troubleshooting or Blueprint Console: Administration -> Debug ->  Troubleshooting
      1. Under the Set Log Level section, set the Log Level to "debug" by using the selection box. Click Set Log Level.
      2. Start a packet capture from the same Troubleshooting Panel. Select the pull-down for Interface Type and select "All Interfaces" or if you already know which interface is used for the affected connection, select the pull-down for Ethernet Interface and select the specific interface.
      3. Set the Maximum Duration for however long you expect it will take to complete your recreate. Optionally, you can also select Continuous. NOTE: Please use caution with regard to memory storage limits.
      4. Click Start Packet Capture.
   2. After recreate the issue, under the Stop Packet Capture section, select the interface and click Stop Packet Capture.
   3. Provide the steps to re-create the issue, include the exact request you are using, the response returned by APIC Gateway, and the time (include timezone) when invoking the API.
3. Download the data and submit to IBM Support for review
   1. Generate DataPower error report:
      1. From the Troubleshooting Panel, under the Generate Error Report section, click Generate Error Report.
      2. Download the error report by clicking the View Error Report link. Or, go to File Management, temporary:/// and click the error report file to download.
   2. Export the packet capture:
      1. From the same Troubleshooting Panel, under the Start Packet Capture section, download the packet capture by clicking the Download Packet Capture link. Or, go to File Management, temporary:/// and click the packet capture file (pcap) to download.
   3. An export of the API's yaml file involved in this issue:
      1. In the API Manager (APIM), click Drafts, and then click APIs tab.
      2. Click the API.
      3. Click the More Actions icon and then click Download.
   4. Each APIC Management server's log files:
      1. In the Cloud Manager Console (CMC), click Services tab.
      2. Navigate to the server and click the Actions icon, then click Download logs.
4. Data can be uploaded to a Case using the link below https://www.secure.ecurep.ibm.com/app/upload_sf