Fixing 502 Bad Gateway error using API Proxy

HTTPS Enabled API Proxy 502 Bad Gateway Error

Steps to fix 502 Bad Gateway Error

Issue Replication Steps:

1.    Create a self-signed JKS certificate

keytool -genkeypair -keystore keystore.jks -dname "CN=localhost, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown" -keypass ******** -storepass ******* -keyalg RSA -sigalg SHA1withRSA -keysize 2048 -alias mule -ext SAN=DNS:localhost,IP:0.0.0.0 -validity 9999

 2.    Create a simple mule application with HTTP Listener using the created JKS certificate in Listener keystore configuration

<? xml version = "1.0" encoding = "UTF-8" ?>

< mule xmlns:tls = "http://www.mulesoft.org/schema/mule/tls" xmlns:http = "http://www.mulesoft.org/schema/mule/http"

      xmlns = "http://www.mulesoft.org/schema/mule/core"

       xmlns:doc = "http://www.mulesoft.org/schema/mule/documentation" xmlns:xsi = "http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation = "http://www.mulesoft.org/schema/mule/core http://www.mulesoft.org/schema/mule/core/current/mule.xsd

http://www.mulesoft.org/schema/mule/http http://www.mulesoft.org/schema/mule/http/current/mule-http.xsd

http://www.mulesoft.org/schema/mule/tls http://www.mulesoft.org/schema/mule/tls/current/mule-tls.xsd" >

       < http:listener-config name = "HTTP_Listener_config" doc:name = "HTTP Listener config" doc:id = "0b269da2-a517-41a9-91cf-66c468871b39" >

             < http:listener-connection protocol = "HTTPS" host = "0.0.0.0" port = "8082" >

                    < tls:context >

                           < tls:key-store type = "jks" path = "keystore/keystore.jks" alias = "mule" keyPassword = "rsdigitech" password = "rsdigitech" />

                    </ tls:context >

             </ http:listener-connection >

       </ http:listener-config >

       < flow name = "test-projectFlow" doc:id = "303a4e7f-3feb-4394-af04-c16a4b2e7e56" >

             < http:listener doc:name = "Listener" doc:id = "0d846d29-820b-42a8-8df6-98e864c0aa57" config-ref = "HTTP_Listener_config" path = "/testjks" />

             < logger level = "INFO" doc:name = "Logger" doc:id = "702ed14b-06eb-42d5-a71b-e711da233c17" message = " #[payload] " />

             < set-payload value = ' #["Success"] ' doc:name = "Set Payload" doc:id = "82baf4cb-cdc2-449f-8603-93c6b51b4e8a" />

       </ flow >

</ mule >

 3.    Deploy the application in Cloudhub and try to invoke it using HTTPS URL, the API returns success response

API Invocation URL : https://simple-https-test-app.us-e2.cloudhub.io/testjks

4.    Deploy a HTTP API proxy pointing to this newly deployed application and invoke Proxy application endpoint, the proxy returns correct response as expected

HTTP API Endpoint Configuration

API Invocation URL : http://test-app-http-proxy-app.us-e2.cloudhub.io/testjks ( Success )

 5. Deploy a separate new HTTPS API proxy pointing to same earlier deployed application, using TLS secret context and same JKS certificate in Keystore, after deployment when we try to invoke Proxy application HTTPS endpoint, the proxy returns HTTP 502 – Bad gateway error

HTTPS API Configuration

API Invocation URL : https://test-app-https-proxy-app.us-e2.cloudhub.io/testjks ( Fails with 502 error )

All Deployed Applications List

Resolution:

We need to specify relevant ciphers while creating TLS context

For example, we have created a JKS certificate as below, using signature algorithm SHA256withRSA, so we have to specify relevant cipher matching with algorithm used in JKS certificate generation at time of creating JKS context and then have to use this context in inbound. PFB the screenshot for reference.

The HTTPS proxy API will work fine then as depicted in screenshots on next page.

keytool -genkey -keystore testks.jks -alias mule -keypass ****** -storepass ****** -keyalg RSA -sigalg SHA256withRSA -validity 365 -keysize 2048

D:workspaceskeystore> keytool -list -v -keystore testks.jks

Enter keystore password:

Keystore type: jks

Keystore provider: SUN

Your keystore contains 1 entry

Alias name: mule

Creation date: 4 May, 2020

Entry type: PrivateKeyEntry

Certificate chain length: 1

Certificate[1]:

Owner: CN=testmuleapp, OU=abctest, O=abc, L=noida, ST=up, C=IN

Issuer: CN=testmuleapp, OU=abctest, O=abc, L=noida, ST=up, C=IN

Serial number: 5b35eb6d

Valid from: Mon May 04 19:55:26 IST 2020 until: Tue May 04 19:55:26 IST 2021

Certificate fingerprints:

        MD5: 41:6E:A0:92:A9:5C:66:F6:B6:A6:BC:EB:A6:D8:51:DD

        SHA1: 8E:31:10:FD:F9:69:3F:29:09:28:AF:69:81:40:AE:2F:73:1F:92:F3

        SHA256: 5B:CE:8E:8F:A6:66:15:E3:C9:68:0E:1D:FD:51:B2:D9:59:B0:2C:1B:0D:44:EF:A3:78:93:D0:5D:EF:02:1D:01

Signature algorithm name: SHA256withRSA

Subject Public Key Algorithm: 2048-bit RSA key

Version: 3

Extensions:

#1: ObjectId: 2.5.29.14 Criticality=false

SubjectKeyIdentifier [

KeyIdentifier [

0000: 77 D1 38 46 7F 68 5C 32  82 E6 FE 42 6E 17 E9 13 w.8F.h2...Bn...

0010: 21 7E 34 99                                       !.4.

]

]

*******************************************

*******************************************