# Packaging keys, certificates and secure configuration

*MuleSoft Developer II Study Guide · Secure data at rest and in transit · Last updated November 7, 2026 · https://www.certifyforce.com/study-guide/mulesoft-developer-ii/secure-data-at-rest-and-in-transit/packaging-keys-certificates-and-secure-configuration*

Create and inspect key and certificate artifacts, install CA replies on the correct entries, and package explicit keystore formats and credentials.

- Certification: Salesforce MuleSoft Developer II
- Exam section: Secure data at rest and in transit
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-developer-ii

**Official exam objective:**

> Create, package, and distribute keys and certificates.

## What the exam expects

- Distinguish a key pair, a signing request, a certificate reply and a trust entry.
- Select Java 8 keytool operations and parameters for each artifact transition.
- Convert selected keystore entries without confusing store and key passwords.
- Package stores using explicit Mule format and path settings.

Key terms: a **CSR** requests CA signing; an **alias** identifies a store entry; a **certificate chain** links a leaf to issuers; a **store password** protects store integrity; a **key password** protects a private-key entry.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Key algorithm | `-keyalg` chooses key generation; `-sigalg` chooses signing. | [keytool](https://docs.oracle.com/javase/8/docs/technotes/tools/unix/keytool.html) |
| CSR generation | `-certreq` uses the existing alias's private key. | [keytool](https://docs.oracle.com/javase/8/docs/technotes/tools/unix/keytool.html) |
| CSR subject | `-dname` can override the subject without generating a new key. | [keytool](https://docs.oracle.com/javase/8/docs/technotes/tools/unix/keytool.html) |
| Reply installation | Target the existing key-entry alias. | [keytool](https://docs.oracle.com/javase/8/docs/technotes/tools/unix/keytool.html) |
| Export extent | A key-entry export returns its first certificate. | [keytool](https://docs.oracle.com/javase/8/docs/technotes/tools/unix/keytool.html) |
| Conversion selection | `-srcalias` selects one entry; `-destalias` names its destination. | [keytool](https://docs.oracle.com/javase/8/docs/technotes/tools/unix/keytool.html) |
| Entry password | An omitted `-destkeypass` retains the source entry password. | [keytool](https://docs.oracle.com/javase/8/docs/technotes/tools/unix/keytool.html) |
| Mule parsing | Set the store type for its contents, independently of its suffix. | [Mule TLS](https://docs.mulesoft.com/mule-runtime/4.6/tls-configuration) |

## Check yourself

- Why should a store inspection without its password retain the warning in the evidence?
- When does certificate inspection avoid requiring a keystore?
- Which two `-list` flags cannot be selected together?

## Sources

- [Java SE 8 keytool](https://docs.oracle.com/javase/8/docs/technotes/tools/unix/keytool.html)
- [TLS Configuration, Mule 4.6](https://docs.mulesoft.com/mule-runtime/4.6/tls-configuration)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 13 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Developer II pack (USD $19): https://www.certifyforce.com/practice-exams