--- schema_version: "1" id: 1a69c751323366ef0c1bbfc2bb9ff55be7df6dc54d98d1e01f7c6ddf5cfe9bb3 title: Create and Edit Secret Groups (Anypoint Platform) collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/anypoint-security/asm-secret-group-creation-task.md canonical_url: https://docs.mulesoft.com/anypoint-security/asm-secret-group-creation-task source_site: docs.mulesoft.com content_type: documentation content_hash: 2b49d88b68ecd68d0e0ac8dc7967fa43f8914181726701bcd8b8df0e04dfcf19 description: MuleSoft Documentation Site latest: true --- --- product: Security version: master --- # Create and Edit Secret Groups (Anypoint Platform) > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Secrets Manager enables you to create and edit secrets groups, which is a logical grouping of secrets. Secrets Manager also enables you to create new secret types and add them to a secrets group. > [!NOTE] A maximum of 25 secret groups are allowed per environment per business group. Each secret > group can contain a maximum of 350 secrets. ## Prerequisites To create and edit secret groups: - Verify that you have the `Write secrets` permission in Access Management. - Verify that you’re in the correct environment using the environment or business group. ## Create a Secret Group 1. In Anypoint Platform, go to **Management Center > Secrets Manager**. 2. Select **Create Secret Group**. 3. Enter a name for the secret group that: - Starts with a letter - Is at least three characters long and no longer than 35 characters - Contains only letters, numbers, and dashes; however, the name can’t end with a dash. 4. Select **Secret Group Downloadable** to allow authenticated users to download secrets outside of Anypoint Platform. > [!NOTE] If you select this option, secrets can be downloaded over public networks. Next, add the secret types to the secret group. ## Add a Truststore Add a truststore for public certificates of trusted servers. The truststore stores up to 15 certificates from the trusted CA, which are then used to verify certificates presented by the server in an SSL connection. 1. In the Secret Groups list view, select the secret group to add the truststore to, and click **Edit**. 2. Select **Truststore** > **Add Truststore**. 3. In **Add Truststore**, add the required information: - **Name** Enter a name for your truststore. - **Type** Select the truststore type: **PEM** JKS **PKCS12** JCEKS - **Truststore File** Click **Choose File** and select the truststore file to upload. - **Override Expiration Date** Select the date to override the default expiration date of the certificate. > [!NOTE] If you’re uploading a JKS, PKCS12, or JCEKS truststore file, you must also provide > the passphrase for this truststore. 4. Click **Save**. ## Add a Keystore Specify the type of keystore to add to the secret group. The keystore is the combination of the authorization certificate, its corresponding private keys, and the certification authority’s path. 1. In the **Secret Groups** list view, select the secret group to add a keystore to, and click **Edit**. 2. Select **Keystore** > **Add Keystore**. 3. In the **Name** field, enter a name for the keystore. 4. In the **Type** field, select the keystore type. Supported types include: - Privacy-Enhanced Mail (PEM) Base64-encoded ASCII file with a `cer`, `crt`, or `pem` extension - Java Keystore (JKS) Repository for authorization or public key certificates. The JKS keystore type doesn’t store secret keys. - PKCS #12 Stores server and intermediate certificates in an archive file format. The PKCS #12 keystore type doesn’t store secret keys. > [!NOTE] Some PKCS12 files generated with newer OpenSSL defaults (AES/SHA-256) might not > upload and can return `RB-1003: invalid content`. If upload fails, generate the PKCS12 file > with Java `keytool` or use OpenSSL legacy PKCS12 settings for broader compatibility. This > approach helps ensure that Secrets Manager can parse the keystore successfully. - Java Cryptography Extension keystore (JCEKS) Stores server and intermediate certificates as well as secret keys. - To add a **PEM** type keystore, you must provide: - **Certificate File** Click **Choose File** to locate and upload the PEM certificate file. - **Key File** Click **Choose File** to locate and upload the PEM-formatted file that contains the private key for the certificate. - **Key Passphrase** Enter the word or phrase that protects the private key. - **CA Path Certificate File** Click **Choose File** to locate and upload the certificate signed by a certification authority (CA). The CA path contains the intermediary and root certificates that are related to the certificate file to use. - **Override Expiration Date** Select the date to override the default expiration date of the certificate. - To add a **JKS**, **PKCS12**, or **JCEKS** type keystore, you must provide: - **Keystore File** Click **Choose File** to locate and upload the keystore file to use. - **Keystore Passphrase** Enter the word or phrase that protects the keystore. - **Alias** The alias used to access the keystore entries (key and trusted certificate entries). - **Key Passphrase** The word or phrase that protects the private key. - **Algorithm** The algorithm to use for encryption of keys. - **Override Expiration Date** Select the date to override the current expiration date of the certificate. 5. Click **Save**. ## Add a Certificate Pinset Add a concatenated list of PEM certificates to the secret group. 1. In the **Secret Groups** list view, select the secret group to add a certificate pinset to, and click **Edit**. 2. Select **Certificate Pinset** > **Add Certificate Pinset**. 3. In the **Certificate Pinset** screen, add the required information. - **Name** Enter a name for the certificate pinset. - **Certificate File** Click **Choose File** and select the PEM formatted CA certificate to upload. - **Expiration Date** Select the expiration date for the certificate. 4. Click **Save**. ## Add a Shared Secret Add a secret users can share for authentication. 1. In the **Secret Groups** list view, select the secret group to add a shared secret to, and click **Edit**. 2. Select **Shared Secret** > **Add Shared Secret**. 3. In the **Add Shared Secret** screen, add the required information: - **Name** Enter a name for your shared secret. - **Type**: - **Username Password** Provide a username and password. - **Symmetric Key** Provide a Base64 string containing symmetric key. - **S3 Credential** Provide the access key ID and the secret access key to an S3 bucket. - **Blob** Provide a Base64-encoded value. 4. Click **Save**. ## Edit a Secret Group Edit a secrets group to add secret types such as keystores, truststores, certificates, etc. 1. In the **Secret Groups** list view, select the secret group you want to edit, then click **Edit**. 2. Make changes to the secrets as required. As you create or save changes to a secret, the changes are applied immediately. The updated secret group is immediately available the next time the secret group is accessed or when deploying an application. ## See Also - [Add a TLS Context for Mule](https://docs.mulesoft.com/anypoint-security/secret-group-add-tls-context) - [Secrets Manager Permissions](https://docs.mulesoft.com/anypoint-security/asm-permission-concept) - [Supported Secret Types Reference](https://docs.mulesoft.com/anypoint-security/asm-secret-type-support-reference) - [Build an HTTPS API Proxy](https://docs.mulesoft.com/api-manager/latest/building-https-proxy)