This topic explains how to enable one-way TLS and mTLS on the ingressgateway.

Configuring one-way TLS

Use one-way TLS to secure API proxy endpoints on the ingress gateway. To enable one-way TLS, you configure the ingress with TLS cert/key pairs or with a KubernetesSecret, as explained in the following options.

Option 1: key/cert pair

Provide SSL cert and key files in thevirtualhosts property in your overrides file:

virtualhosts:- name:$ENVIRONMENT_GROUP_NAME    sslCertPath: "$CERT_FILE"    sslKeyPath: "$KEY_FILE"

Where$ENVIRONMENT_GROUP_NAME is the name of an environment group with corresponding host aliases, and$CERT_FILE and$KEY_FILE are TLS key and certificate files. SeeCreate TLS certificates.

Create aKubernetes Secret and add it to your overrides file.

1. Create the Secret in theapigee namespace:

   kubectl create -nAPIGEE_NAMESPACE secret generic$SECRET_NAME  \  --from-file=key=$KEY_FILE \  --from-file=cert=$CERT_FILE

2. Configure thevirtualhosts property in your overrides file:

   virtualhosts:- name:$ENVIRONMENT_GROUP_NAME    tlsMode: SIMPLE  # Note: SIMPLE is the default, so it is optional.    sslSecret:$SECRET_NAME

Note: See
• virtualhosts.name
• virtualhosts.tlsMode
• virtualhosts.sslSecret

Configuring mTLS

Important: Public Certificate Authorities (CAs) are discontinuing the inclusion of theclientAuth Extended Key Usage (EKU) in latest publicly-trusted SSL/TLS certificates. This industry-wide change affects Apigee mutual TLS (mTLS) configurations inApigee platform.

Apigee requires theclientAuth EKU to be present in client certificates for mTLS handshakes. Without this EKU, mTLS connections will fail for both northbound (client to Apigee) and southbound (Apigee to backend) traffic. For a detailed explanation of the issue, timelines, and recommended solutions, refer to thisblog post.

Instead of one-way TLS, you can configuremTLS on the ingress gateway. There are two options for configuring mTLS, as explained below.

Option 1: key/cert pair and CA file

Provide TLS certificate data containing Certificate Authority certificates:

virtualhosts:- name:$ENVIRONMENT_GROUP_NAME    tlsMode: MUTUAL    caCertPath: "$CA_FILE"    sslCertPath: "$CERT_FILE"    sslKeyPath: "$KEY_FILE"

Note: See
• virtualhosts.name
• virtualhosts.tlsMode
• virtualhosts.caCertPath
• virtualhosts.sslCertPath
• virtualhosts.sslKeyPath

Where$ENVIRONMENT_GROUP_NAME is the name of an environment group with corresponding host aliases,$CA_FILE specifies TLS certificate data (CA bundle file) containing Certificate Authority certificates, and$CERT_FILE and$KEY_FILE are TLS key and certificate files. SeeCreate TLS certificates.

Option 2: Kubernetes Secrets

Create two Kubernetes Secrets. The first secret is for the SSL cert/key pair and the second is for the CA. Then, add them to your overrides file.

1. Create two Kubernetes secrets theapigee namespace:

   kubectl create -nAPIGEE_NAMESPACE secret generic$SECRET_NAME  \  --from-file=key=$KEY_FILE \  --from-file=cert=$CERT_FILE

2. Create a secret for the CA:

   kubectl create -nAPIGEE_NAMESPACE secret generic$SECRET_NAME-cacert  \  --from-file=cacert=$CA_FILE

3. Configure thevirtualhosts property in your overrides file:

   virtualhosts:- name:$ENVIRONMENT_GROUP_NAME    tlsMode: MUTUAL  # Note: Be sure to specify MUTUAL    sslSecret:$SECRET_NAME

Note: See
• virtualhosts.name
• virtualhosts.tlsMode
• virtualhosts.sslSecret