Secrets manager TLS contexts and edge access
How Anypoint Security secrets manager stores TLS artifacts for trusted platform services, what its secret groups, permissions and limits allow, how an HTTPS API proxy consumes a TLS context, and how CloudHub 2.0 private space ingress enforces TLS and mutual TLS at the edge.
Design secure edge access using Anypoint Security.
~8 min read · 5 practice questions
What the exam expects
- Recognize what Anypoint Security secrets manager is for, which secret types platform services can consume, and which they cannot.
- Grant the least-privilege Secrets Manager or API Manager permissions for creating secret groups, uploading TLS artifacts and applying a TLS context.
- Configure a secret group and TLS context that an HTTPS API proxy can use, and size secret groups within the documented limits.
- Design edge TLS and mutual TLS (mTLS) on CloudHub 2.0 private space ingress, including what changes from a CloudHub 1.0 dedicated load balancer (DLB).
Secrets manager: an Anypoint Security vault for keys, certificates and other secrets that trusted platform services consume on your behalf (Secrets Manager Overview). Secret group: a vault tied to one environment and business group, with its own encryption keys (Secrets Manager Overview). TLS context: SSL security parameters such as ciphers and TLS version, combined with a keystore and optional truststore (Add a TLS Context to Mule). Truststore: certificates of parties or certificate authorities you trust (Secrets Manager Overview).
Key facts
- Detail
- 25 per environment per business group
- Detail
- Up to 350
- Detail
- Defined but not consumable by platform services
- Detail
- Only the internal Secrets Provider
- Detail
- Manage Runtime Fabric covers secrets manager
- Detail
- Downloadable group; target Mule
- Detail
- Read secrets metadata plus Manage API Configuration
- Detail
- TLS 1.3; TLS 1.2 optional
- Detail
- Up to 15 certificates
- Detail
- Not supported: pass or reject
- Detail
- Client authentication disabled
Sources for this section (6)
- Secrets Manager Overviewdocs.mulesoft.com (opens in a new tab)
- Create and Edit Secret Groupsdocs.mulesoft.com (opens in a new tab)
- Build HTTPS API Proxiesdocs.mulesoft.com (opens in a new tab)
- Add a TLS Context to Muledocs.mulesoft.com (opens in a new tab)
- Compare CloudHub and CloudHub 2.0docs.mulesoft.com (opens in a new tab)
- Configuring Domains and Certificatesdocs.mulesoft.com (opens in a new tab)
- When do edits to a secret group take effect for services that use it?
- Why must the TLS SNI value match the request's Host header on a CloudHub 2.0 private space?
- Which Access Management permission is needed to create or edit a CloudHub 2.0 private space TLS context?
- Which naming rules must a new secret group name meet?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the MuleSoft Platform Integration Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 40 lessons of the MuleSoft Platform Integration Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Practice exams purchase adds inline bank questions and topic practice (5 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Choose guide-only, practice-only, or save $4 with both