# Mutual TLS and certificate validation

*MuleSoft Developer II Study Guide · Secure data at rest and in transit · Last updated November 7, 2026 · https://www.certifyforce.com/study-guide/mulesoft-developer-ii/secure-data-at-rest-and-in-transit/mutual-tls-and-certificate-validation*

Configure mutual client/server identity, distinguish revocation controls, and apply the exact Mule 4.6 schema and Java revocation contracts.

- Certification: Salesforce MuleSoft Developer II
- Exam section: Secure data at rest and in transit
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-developer-ii

**Official exam objective:**

> Implement transport layer security (TLS) mutual authentication on the client and server side.

## What the exam expects

- Supply the client's and server's own identities and their peer-trust material.
- Select a private-key identity and read the presented client certificate.
- Separate revocation preference, fallback, chain scope and indeterminate-status policy.
- Choose one valid revocation mechanism and satisfy its input requirements.

Key terms: **mutual TLS** authenticates both TLS peers; an **end entity** is a presented leaf identity; **OCSP** queries certificate status; a **CRL** lists revoked certificates; a **trust anchor** grounds certificate-path trust.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Identity selector | Key-store alias selects a private-key entry. | [HTTP reference](https://raw.githubusercontent.com/mulesoft/docs-connectors/33276ccdb80668dd8bd45102a529a5fcc0918eea/http/1.9/modules/ROOT/pages/http-documentation.adoc) |
| Listener certificate | Direct two-way TLS exposes `attributes.clientCertificate`. | [HTTP reference](https://raw.githubusercontent.com/mulesoft/docs-connectors/33276ccdb80668dd8bd45102a529a5fcc0918eea/http/1.9/modules/ROOT/pages/http-documentation.adoc) |
| Default selection | No revocation mechanism is selected by the builder. | [TLS builder](https://github.com/mulesoft/mule-api/blob/badcc8877b1ec69dbaadc74ff5a328e767fad8b8/src/main/java/org/mule/runtime/api/tls/TlsContextFactoryBuilder.java) |
| Wrapper shape | Select exactly one revocation mechanism child. | [TLS schema](https://github.com/mulesoft/mule/blob/f686c2d3f2ed5f3153e2ffa0a9702eab51082a14/runtime-extension-model/src/main/resources/META-INF/mule-tls.xsd) |
| Fallback control | `noFallback=true` maps to `NO_FALLBACK`. | [Mule checker](https://github.com/mulesoft/mule/blob/f686c2d3f2ed5f3153e2ffa0a9702eab51082a14/modules/tls/src/main/java/org/mule/runtime/module/tls/internal/revocation/StandardRevocationCheck.java) |
| Chain scope | Only End Entities limits checking to end-entity certificates. | [Java options](https://docs.oracle.com/javase/8/docs/api/java/security/cert/PKIXRevocationChecker.Option.html) |
| Custom signer | The response-signing certificate belongs in the truststore. | [Custom OCSP](https://github.com/mulesoft/mule/blob/f686c2d3f2ed5f3153e2ffa0a9702eab51082a14/modules/tls/src/main/java/org/mule/runtime/module/tls/internal/revocation/CustomOcspResponder.java) |
| CRL inputs | Supply readable CRLs and the explicitly required truststore. | [CRL implementation](https://github.com/mulesoft/mule/blob/f686c2d3f2ed5f3153e2ffa0a9702eab51082a14/modules/tls/src/main/java/org/mule/runtime/module/tls/internal/revocation/CrlFile.java) |

## Check yourself

- Why should a diagnostic report use a separate annotated collection?
- When must the prior run's ignored-exception evidence be captured?
- How is the returned list ordered?

## Sources

- [TLS Configuration, Mule 4.6](https://docs.mulesoft.com/mule-runtime/4.6/tls-configuration)
- [HTTP Connector 1.9 Reference](https://raw.githubusercontent.com/mulesoft/docs-connectors/33276ccdb80668dd8bd45102a529a5fcc0918eea/http/1.9/modules/ROOT/pages/http-documentation.adoc)
- [Mule 4.6 TLS schema](https://github.com/mulesoft/mule/blob/f686c2d3f2ed5f3153e2ffa0a9702eab51082a14/runtime-extension-model/src/main/resources/META-INF/mule-tls.xsd)
- [Mule 4.6 StandardRevocationCheck](https://github.com/mulesoft/mule/blob/f686c2d3f2ed5f3153e2ffa0a9702eab51082a14/modules/tls/src/main/java/org/mule/runtime/module/tls/internal/revocation/StandardRevocationCheck.java)
- [Mule 4.6 CustomOcspResponder](https://github.com/mulesoft/mule/blob/f686c2d3f2ed5f3153e2ffa0a9702eab51082a14/modules/tls/src/main/java/org/mule/runtime/module/tls/internal/revocation/CustomOcspResponder.java)
- [Mule 4.6 CrlFile](https://github.com/mulesoft/mule/blob/f686c2d3f2ed5f3153e2ffa0a9702eab51082a14/modules/tls/src/main/java/org/mule/runtime/module/tls/internal/revocation/CrlFile.java)
- [TLS builder contract](https://github.com/mulesoft/mule-api/blob/badcc8877b1ec69dbaadc74ff5a328e767fad8b8/src/main/java/org/mule/runtime/api/tls/TlsContextFactoryBuilder.java)
- [Java 8 revocation options](https://docs.oracle.com/javase/8/docs/api/java/security/cert/PKIXRevocationChecker.Option.html)
- [Java 8 PKIXRevocationChecker](https://docs.oracle.com/javase/8/docs/api/java/security/cert/PKIXRevocationChecker.html)
- [OAuth Module 1.1 generated reference](https://raw.githubusercontent.com/mulesoft/docs-connectors/e670e4fa926b805cff09b3a6d377a92bc4a6bb12/oauth/1.1/modules/ROOT/pages/oauth-module-reference.adoc)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 12 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Developer II pack (USD $19): https://www.certifyforce.com/practice-exams