API Manager 2.x enables you to use the secrets stored in your secret group to build an HTTPS-based API for your CloudHub or hybrid deployments. By configuring a TLS context for your inbound and outbound traffic, you can ensure your traffic’s security.
The secrets manager integration is only supported by API Proxies running Mule 4 on CloudHub, Hybrid, or standalone deployments. Supported keystores for the TLS context are JCEKS, PKCS12, and JKS.
To build an HTTPS Proxy in a Mule 3 or Runtime Fabric deployment target, see Build an HTTPS Service.
To configure your HTTPS API Proxy using secrets stored in your secret group, ensure you have:
-
Requested the following permissions from your Anypoint Platform admin:
-
Secrets Manager permissions
To configure an existing TLS context for the API Proxy, you need the Read secrets metadata permission. Review the Secrets Manager Permissions reference for more information. -
API Manager permissions
To apply a TLS context to an API proxy in API Manager, you need the Manage API Configuration role. See the API Manager section of the Permissions by Product page for more information.
-
-
Created a Secret Group
Enable the Secret Group Downloadable checkbox. -
Added a TLS Context
Set TLS context’s target to Mule.
Configure your HTTPS API Proxy by completing the following tasks:
You can deploy your API proxy to CloudHub, hybrid, or standalone servers.
After you configured your API Proxy and selected CloudHub as the Proxy deployment target, your API Proxy will be automatically deployed, with the secrets already configured.
Your secrets are configured as secure property placeholders under the SecureProperties in your mule-artifact.json.
The amount of properties supplied depends on your selected configuration:
inbound.keystore.keyPassword_281324
inbound.keystore.password_281324
inbound.truststore.password_281324
outbound.keystore.keyPassword_281324
outbound.keystore.password_281324
outbound.truststore.password_281324The 281324 suffix in this case is API Instance ID of your API Proxy.
If you inspect your API Proxy’s XML, you can see these properties being used in your trustore/keystore configurations:
<tls:trust-store path="outbound-truststore.jks" password="${outbound.truststore.password_281324}" type="JKS" insecure="true" />After you configure your API Proxy and select Hybrid as the Proxy deployment target, your API Proxy is automatically deployed, with the secrets already configured.
Your secrets are configured as secure property placeholders under the SecureProperties in your mule-artifact.json.
+ The amount of properties supplied depends on your selected configuration:
inbound.keystore.keyPassword_281324
inbound.keystore.password_281324
inbound.truststore.password_281324
outbound.keystore.keyPassword_281324
outbound.keystore.password_281324
outbound.truststore.password_281324The 281324 suffix in this case is API Instance ID of your API Proxy.
If you inspect your API Proxy’s XML, you can see these properties being used in your trustore/keystore configurations:
<tls:trust-store path="outbound-truststore.jks" password="${outbound.truststore.password_281324}" type="JKS" insecure="true" />To deploy your API Proxy to a standalone server, provide secured properties for each TLS Context.
-
Download the API Proxy.
-
In API Manager, select the version of the API proxy you want to download.
-
Click the Actions button in the top-right corner of your screen and select Download Proxy.
-
-
Take note of your API Instance ID under API Instance.
-
When running your standalone Mule instance, you need to provide the keystore and key passphrases as -D arguments, along with your API Proxy’s API Instance ID.
For example, if your API instance ID is 15464957, you need to pass the arguments:./bin/mule \ -M-Dinbound.keystore.keyPassword_15464957=pass123 \ -M-Dinbound.keystore.password_15464957=pass123 \ -M-Dinbound.truststore.password_15464957=pass123 \ -M-Doutbound.keystore.keyPassword_15464957=pass123 \ -M-Doutbound.keystore.password_15464957=pass123 \ -M-Doutbound.truststore.password_15464957=pass123
