You're viewing **Apigee Edge** documentation.  
[Go to the
**Apigee X** documentation](http://cloud.google.com/apigee/docs/api-platform/system-administration/options-configuring-tls). info

> [!NOTE]
> **Note:** The instructions in this document are applicable for Edge Private Cloud users only.


This document explains how to verify that the correct client certificates have been uploaded
to Apigee Edge Routers. The process of validating certificates relies on OpenSSL, which is
the underlying mechanism used by NGINX on Apigee Edge Routers.


Any mismatch in the certificates sent by the client applications as part of the API request
and the certificates stored on Apigee Edge Routers will lead to
[400 Bad Request - SSL Certificate errors](https://docs.apigee.com/api-platform/troubleshoot/runtime/400-ssl-certificate-error). Validating the certificates using the process
described in this document can help you to proactively detect these issues and prevent any
certificate errors at runtime.

> [!NOTE]
> **Note:** This is applicable only if you have configured [two-way mutual TLS](https://docs.apigee.com/api-platform/system-administration/about-ssl#twowaytls) between the client application and Apigee Edge.

## Before you begin


Before you use the steps in this document, be sure you understand the following topics:

- If you aren't familiar with the OpenSSL library, read [OpenSSL](https://en.wikipedia.org/wiki/OpenSSL).
- If you want to use the command-line examples in this guide, install or update to the latest version of [OpenSSL client](https://www.openssl.org/source/).
- Ensure the certificates are in PEM format and if not, [convert the certificates to PEM format](https://docs.apigee.com/how-to-guides/converting-certificates-to-supported-format).

## Validating client certificates against truststore on Apigee Routers


This section describes the steps used to verify that the client certificates are identical to
certificates stored in the truststore on Apigee Edge Routers.

1. Login to one of the Router machines.
2. Navigate to the `/opt/nginx/conf.d` folder, where the certificates are stored in Apigee Edge Routers' truststore.
3. Identify the truststore for which you would like to validate the client certificates. The truststore name is in the following format:

   ```rust
   org-env-virtualhost-client.pem
   ```


   Where:
   - <var translate="no">org</var> is your Apigee organization name
   - <var translate="no">env</var> is your Apigee environment name
   - <var translate="no">virtualhost</var> is your Apigee virtual host name
   - For example, to validate for the following:
     - Organization: `myorg`
     - Environment: `test`
     - Virtual host: `secure`
   - The truststore name is: `myorg-test-secure-client.pem`
4. From your local machine, transfer the actual client certificate that you want to validate to the `/tmp` directory on the Router, using `scp`, `sftp` or any other utility.


   For example, use the `scp` command as follows:

   ```rust
   scp client_cert.pem router-host:/tmp
   ```


   Where <var translate="no">router-host</var> is the name of Router machine.
5. Verify the client certificate using OpenSSL as follows:

   ```rust
   openssl verify -trusted org-env-virtualhost-client.pem /tmp/client-cert.pem
   ```


   Where:
   - <var translate="no">org</var> is your Apigee organization name
   - <var translate="no">env</var> is your Apigee environment name
   - <var translate="no">virtualhost</var> is your Apigee virtual host name
6.
   Fix any errors that are returned from the command above.


   If the truststore on the Apigee Edge Router doesn't contain the correct certificates,
   delete and upload the correct certificates in PEM format to the truststore using this
   [Upload certificate to truststore API](https://apidocs.apigee.com/docs/keystores-and-truststores/1/routes/organizations/%7Borg_name%7D/environments/%7Benv_name%7D/keystores/%7Bkeystore_name%7D/certs/post).

> [!NOTE]
> **Note:** The steps above can also be used to validate the client certificate stored on any NGINX based backend server's truststore. The location of the truststore and naming convention of the file on your NGINX based backend server may be different from that of Apigee.