# Secrets manager TLS contexts and edge access

*MuleSoft Platform Integration Architect Study Guide · Designing integration solutions to meet security requirements · Last updated November 13, 2026 · https://www.certifyforce.com/study-guide/mulesoft-platform-integration-architect/designing-integration-solutions-to-meet-security-requirements/secrets-manager-tls-contexts-and-edge-access*

How Anypoint Security secrets manager stores TLS artifacts for trusted platform services, what its secret groups, permissions and limits allow, how an HTTPS API proxy consumes a TLS context, and how CloudHub 2.0 private space ingress enforces TLS and mutual TLS at the edge.

- Certification: Salesforce MuleSoft Platform Integration Architect
- Exam section: Designing integration solutions to meet security requirements
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-platform-integration-architect

**Official exam objective:**

> Design secure edge access using Anypoint Security.

## What the exam expects

- Recognize what Anypoint Security secrets manager is for, which secret types platform services can consume, and which they cannot.
- Grant the least-privilege Secrets Manager or API Manager permissions for creating secret groups, uploading TLS artifacts and applying a TLS context.
- Configure a secret group and TLS context that an HTTPS API proxy can use, and size secret groups within the documented limits.
- Design edge TLS and mutual TLS (mTLS) on CloudHub 2.0 private space ingress, including what changes from a CloudHub 1.0 dedicated load balancer (DLB).

**Secrets manager:** an Anypoint Security vault for keys, certificates and other secrets that trusted platform services consume on your behalf ([Secrets Manager Overview](https://docs.mulesoft.com/anypoint-security/index-secrets-manager)). **Secret group:** a vault tied to one environment and business group, with its own encryption keys ([Secrets Manager Overview](https://docs.mulesoft.com/anypoint-security/index-secrets-manager)). **TLS context:** SSL security parameters such as ciphers and TLS version, combined with a keystore and optional truststore ([Add a TLS Context to Mule](https://docs.mulesoft.com/anypoint-security/secret-group-add-tls-context)). **Truststore:** certificates of parties or certificate authorities you trust ([Secrets Manager Overview](https://docs.mulesoft.com/anypoint-security/index-secrets-manager)).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Secret group limit | 25 per environment per business group | [Secrets Manager Overview](https://docs.mulesoft.com/anypoint-security/index-secrets-manager) |
| Secrets per group | Up to 350 | [Create and Edit Secret Groups](https://docs.mulesoft.com/anypoint-security/asm-secret-group-creation-task) |
| Shared secret types | Defined but not consumable by platform services | [Secrets Manager Overview](https://docs.mulesoft.com/anypoint-security/index-secrets-manager) |
| Reading secret values | Only the internal Secrets Provider | [Secrets Manager Overview](https://docs.mulesoft.com/anypoint-security/index-secrets-manager) |
| Runtime Fabric managers | Manage Runtime Fabric covers secrets manager | [Secrets Manager Overview](https://docs.mulesoft.com/anypoint-security/index-secrets-manager) |
| Proxy TLS context prerequisites | Downloadable group; target Mule | [Build HTTPS API Proxies](https://docs.mulesoft.com/api-manager/latest/building-https-proxy) |
| Applying a TLS context to a proxy | Read secrets metadata plus Manage API Configuration | [Build HTTPS API Proxies](https://docs.mulesoft.com/api-manager/latest/building-https-proxy) |
| TLS context default version | TLS 1.3; TLS 1.2 optional | [Add a TLS Context to Mule](https://docs.mulesoft.com/anypoint-security/secret-group-add-tls-context) |
| Truststore capacity in a secret group | Up to 15 certificates | [Create and Edit Secret Groups](https://docs.mulesoft.com/anypoint-security/asm-secret-group-creation-task) |
| CloudHub 2.0 optional mTLS | Not supported: pass or reject | [Compare CloudHub and CloudHub 2.0](https://docs.mulesoft.com/cloudhub-2/ch2-migration-comparison) |
| Private space TLS context without truststore | Client authentication disabled | [Configuring Domains and Certificates](https://docs.mulesoft.com/cloudhub-2/ps-config-domains) |

## Check yourself

- When do edits to a secret group take effect for services that use it?
- Why must the TLS SNI value match the request's Host header on a CloudHub 2.0 private space?
- Which Access Management permission is needed to create or edit a CloudHub 2.0 private space TLS context?
- Which naming rules must a new secret group name meet?

## Sources

- [Anypoint Security Secrets Manager Overview](https://docs.mulesoft.com/anypoint-security/index-secrets-manager)
- [Create and Edit Secret Groups (Anypoint Platform)](https://docs.mulesoft.com/anypoint-security/asm-secret-group-creation-task)
- [Add a TLS Context to Mule](https://docs.mulesoft.com/anypoint-security/secret-group-add-tls-context)
- [Anypoint Platform Secrets Manager Permissions](https://docs.mulesoft.com/anypoint-security/asm-permission-concept)
- [Build HTTPS API Proxies](https://docs.mulesoft.com/api-manager/latest/building-https-proxy)
- [Anypoint Security Overview](https://docs.mulesoft.com/anypoint-security/)
- [Compare CloudHub and CloudHub 2.0](https://docs.mulesoft.com/cloudhub-2/ch2-migration-comparison)
- [Configuring Domains and Certificates (TLS Context) for a Private Space](https://docs.mulesoft.com/cloudhub-2/ps-config-domains)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 5 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Platform Integration Architect pack (USD $19): https://www.certifyforce.com/practice-exams