New IA - Certificates

[sharadregoti]

User description

For internal users - Please add a Jira DX PR ticket to the subject!

---

Preview Link

https://deploy-preview-5879--tyk-docs.netlify.app/docs/nightly/api-management/certificates/

Description

Screenshots (if appropriate)

Checklist

• I have added a preview link to the PR description.
• I have reviewed the suggestions made by our AI (PR Agent) and updated them accordingly (spelling errors, rephrasing, etc.)
• I have reviewed the guidelines for contributing to this repository.
• I have read the technical guidelines for contributing to this repository.
• Make sure you have started your change off our latest master.
• I labeled the PR

---

PR Type

Documentation

---

Description

• Introduced a new consolidated documentation page certificates.md for TLS/SSL and certificate management.

• Removed redundant and outdated documentation files related to TLS/SSL and certificate pinning.

• Updated navigation and aliases to reflect the new structure and remove deprecated paths.

• Added a new FAQ entry for adding custom certificates to Docker images.

---

Changes walkthrough 📝

	Relevant files
Documentation	certificates.md New consolidated TLS/SSL and certificate management documentation tyk-docs/content/api-management/certificates.md Added comprehensive documentation for enabling TLS/SSL in Tyk Gateway and Dashboard. Included details on certificate pinning, supported TLS versions, and cipher suites. Provided examples for Kubernetes and Docker configurations. Consolidated content from multiple deprecated files into a single page. +607/-0  troubleshooting-debugging.md Added FAQ for custom certificates in Docker images              tyk-docs/content/api-management/troubleshooting-debugging.md Added a new FAQ section for adding custom certificates to Docker images. Provided examples for Docker and Kubernetes configurations. +22/-0    tls-and-ssl.md Removed outdated TLS and SSL documentation                              tyk-docs/content/basic-config-and-security/security/tls-and-ssl.md Removed outdated TLS and SSL documentation. Content consolidated into certificates.md. +0/-370  add-custom-certificates-to-docker-images.md Removed redundant FAQ for custom certificates                        tyk-docs/content/frequently-asked-questions/add-custom-certificates-to-docker-images.md Removed redundant FAQ page for adding custom certificates. Content moved to troubleshooting section. +0/-32    certificate-pinning.md Removed outdated certificate pinning documentation              tyk-docs/content/security/certificate-pinning.md Removed outdated certificate pinning documentation. Content consolidated into certificates.md. +0/-220
Configuration changes	alias.json Updated aliases for new documentation structure                    tyk-docs/data/alias.json Updated aliases to redirect deprecated paths to the new certificates.md. Added alias for the new FAQ entry. +4/-1      menu.yaml Updated navigation for new documentation structure              tyk-docs/data/menu.yaml Updated navigation to include the new certificates.md page. Removed links to deprecated TLS/SSL and certificate pinning pages. +4/-16

---

💡 PR-Agent usage: Comment /help "your question" on any pull request to receive relevant information

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 4 🔵🔵🔵🔵⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Documentation Clarity The documentation includes a "TODO" note regarding the host_config.generate_secure_paths flag in the tyk_analytics.conf file. This should be clarified or completed to avoid confusion for users. TODO: Deprecated Features The note mentions that Subject.CommonName is deprecated and its support will be removed in Tyk V5. Ensure this is clearly communicated and alternatives are provided to users. `Subject.CommonName` is deprecated and its support will be removed in Tyk V5. {{< /note >}} Certificate Pinning Configuration The example for certificate pinning using Kubernetes secrets could benefit from additional clarity, especially regarding the tls.crt field and its expected content. {{< /warning >}} The example below illustrates a scenario where the public key from the Kubernetes secret object, *httpbin-secret*, is used for all domains, denoted by the wildcard character '*'. In this example the *tls.crt* field of the secret is set to the actual public key of *httpbin.org*. Subsequently, if you any URL other than https://httpbin.org is targetted (e.g. https://github.com/) a *public key pinning error* will be raised for that particular domain. This is because the public key of *httpbin.org* has been configured for all domains. ```yaml # ApiDefinition object 'pinned_public_keys_refs' field uses the following format: # spec: # pinned_public_keys_refs: # "domain.org": <secret_name> # the name of the Kubernetes Secret Object that holds the public key for the 'domain.org'. # # In this way, you can refer to Kubernetes Secret Objects through 'pinned_public_keys_refs' field. # # In this example, we have an HTTPS upstream target as `https://httpbin.org`. The public key of httpbin.org is obtained # with the following command: # $ openssl s_client -connect httpbin.org:443 -servername httpbin.org 2>/dev/null | openssl x509 -pubkey -noout # # Note: Please set tls.crt field of your secret to actual public key of httpbin.org. # # We are creating a secret called 'httpbin-secret'. In the 'tls.crt' field of the secret, we are specifying the public key of the # httpbin.org obtained through above `openssl` command, in the decoded manner. # apiVersion: v1 kind: Secret metadata: name: httpbin-secret type: kubernetes.io/tls data: tls.crt: <PUBLIC_KEY> # Use tls.crt field for the public key. tls.key: ""

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Score
General	Replace or resolve the TODO placeholder to provide clear instructions for users Ensure that the TODO placeholder for setting the host_config.generate_secure_paths flag is replaced with the correct instructions or removed if not applicable, as leaving it unresolved could confuse users. tyk-docs/content/api-management/certificates.md [114-115] -TODO: Finally, set the [host_config.generate_secure_paths]({{< ref "tyk-dashboard/configuration#host_configgenerate_secure_paths" >}}) flag to `true` in your `tyk_analytics.conf` Suggestion importance[1-10]: 9 Why: Resolving the TODO placeholder is crucial for providing clear and actionable instructions to users. Leaving it unresolved could lead to confusion and incomplete configurations.	9
	Clarify the deprecation of Subject.CommonName to help users prepare for its removal Add a warning or clarification about the deprecation of Subject.CommonName to ensure users are aware of its upcoming removal and can plan accordingly. tyk-docs/content/api-management/certificates.md [232] -`Subject.CommonName` is deprecated and its support will be removed in Tyk V5. +`Subject.CommonName` is deprecated and its support will be removed in Tyk V5. Please ensure to update your configurations to use `DNSNames` instead to avoid future compatibility issues. Suggestion importance[1-10]: 8 Why: Adding clarification about the deprecation helps users plan for future changes and ensures compatibility with upcoming versions, which is important for smooth transitions.	8
	Fix a typo in the documentation to improve clarity and professionalism Correct the typo in "ceritficate" to "certificate" in the section about dynamically setting SSL certificates for custom domains to maintain professionalism and clarity. tyk-docs/content/api-management/certificates.md [252] -If you include certificateID or certificate path to an API definition `certificates` field, Gateway will dynamically load this ceritficate for your custom domain, so you will not need to restart the process. +If you include certificateID or certificate path to an API definition `certificates` field, Gateway will dynamically load this certificate for your custom domain, so you will not need to restart the process. Suggestion importance[1-10]: 7 Why: Correcting the typo enhances the professionalism and readability of the documentation, ensuring users clearly understand the instructions.	7
Security	Emphasize the security risks of disabling SSL verification in production environments Clarify the statement about disabling SSL verification in production environments to emphasize the security risks and discourage its use unless absolutely necessary. tyk-docs/content/api-management/certificates.md [353-354] -Alternatively, you can disable the verification of SSL certs in the component configurations below. **You shouln't do this in production!** +Alternatively, you can disable the verification of SSL certs in the component configurations below. **This is highly discouraged in production environments due to significant security risks and should only be used for testing purposes.** Suggestion importance[1-10]: 8 Why: The suggestion improves the documentation by strongly discouraging insecure practices in production environments, which is critical for maintaining security.	8

[netlify]

✅ PS. Pls add /docs/nightly to the end of url

Name	Link
🔨 Latest commit	d7c9044
🔍 Latest deploy log	https://app.netlify.com/sites/tyk-docs/deploys/677f7ef40f146b00088d4dde
😎 Deploy Preview	https://deploy-preview-5879--tyk-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.