Contact Us 1-800-596-4880
  1. Homepage
  2. Runtime Fabric (1.10)
  3. On VMs / Bare Metal

  4. Import a TLS Context from Secrets Manager (Advanced)

Import a TLS Context from Secrets Manager (Advanced)

If your environment has specific security requirements or requires advanced configuration, such as selecting particular ciphers or TLS suites or certificate pinning, you can import a TLS context from the secrets manager.

Prerequisites

You must have the following permissions to import a TLS context from the secrets manager:

  • Grant access to secrets

  • Manage Secret Groups

  • Read secrets metadata

  • Write secrets

These permissions are set using the Secrets Manager tab in Anypoint Access Management:

  1. From Anypoint Platform, select Access Management.

    If you have access, execute the following steps to add the permission:

  2. Select Users.

  3. Locate the row containing your username and then select the link in the Username column.

  4. In the Secrets Manager tab:

    1. Select Environment and then select your environment from the drop-down list.

    2. Select Permission(s) and then select Select Access.

    3. Select Select all.

      It can take up to five minutes for any permissions you add to propagate.

Add a TLS Context to a Secrets Group

Before you can import the TLS context from the secrets manager, you must add a TLS context.

Adding a TLS context to your secrets group involves supplying a name, target, security information, version, keystore, and, optionally, truststore.

  1. In the Secret Groups list, select the secrets group to which you want to add a TLS context.

  2. Select TLS Context in the menu on the left, and click Add TLS Context.

  3. In the Create TLS Context window, add the required information:

    • Name
      Enter a name for your TLS context.

    • Target
      Select Anypoint Security to validate the SSL handshake for Runtime Fabric.

    • TLS Version
      By default, TLS 1.2 and TLS 1.3 are selected.
      For information about the advantages of TLS 1.3, see TLS Support on Anypoint Runtime Fabric.

    • Keystore
      From the drop-down list, select the keystore to store the TLS context.
      For information about adding a keystore to the secrets manager, see Create a Secrets Group.
      You can select keystores that are either PEM or non-PEM types.

    • Optionally select a truststore to which to add the TLS context if you are using a truststore to store certificates trusted by the client.
      A truststore is required if you are going to enable client authentication.

    • Expiration Date
      Optionally select the expiration date for the certificate.

  4. Optionally enable client authentication.

  5. Optionally select ciphers.

  6. Click Add certificate.

Import a TLS Context to Runtime Fabric

  1. In Runtime Manager > Runtime Fabrics > Inbound Traffic > Add certificates, select Import from Secrets Manager.

    This option imports a TLS context from the secrets manager, and supports advanced configuration such client authentication (mutual authentication), selecting ciphers, and selecting TLS versions.

  2. Select the environment with which the secrets group that contains the TLS context is associated.

  3. Select the secrets group where the TLS context is configured.

  4. Select the TLS context to use for Runtime Fabric.

  5. Optionally can click View Details to see details of the TLS context you are importing.

See Also