Resilient REST APIs With SSL/TLS Client Certificates

This article has been indexed from DZone Security Zone

This Zato how-to is about ensuring that only API clients with valid SSL/TLS certificates, including expected certificate fingerprints or other metadata, can invoke selected REST endpoints. In this way, we are making access to the endpoints secure and, at the same time, we can guard against a class of faults related to the Certificate Authority infrastructure. 

Overview

Given that in front of all Zato servers in a cluster is a load-balancer, it is the load-balancer that accepts API client connections.

Read the original article: Resilient REST APIs With SSL/TLS Client Certificates