--- schema_version: "1" id: 3e7b57c97df4472f9c8c469c1cd4252929104dfe61d2d619bce59e2abea25557 title: Configuring Domains and Certificates (TLS Context) for a Private Space collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cloudhub-2/ps-config-domains.md canonical_url: https://docs.mulesoft.com/cloudhub-2/ps-config-domains source_site: docs.mulesoft.com content_type: documentation content_hash: 16b1f6446693cd65389f173d38c5a269b2d1bc4435485a9205be0f4471e59788 description: MuleSoft Documentation Site latest: true --- # Configuring Domains and Certificates (TLS Context) for a Private Space CloudHub 2.0 uses Transport Layer Security (TLS) contexts to encrypt inbound traffic to the private space. TLS contexts enable your apps to be reached at custom domains and, optionally, enable partial client authentication. Each private space includes one TLS context by default (for traffic to `cloudhub.io`), which can’t be removed. The default certificate renews automatically and requires no action from the user. You can create additional TLS contexts as required.

The cloudhub.io parent domain is shared across all customers, control planes, and regions. Because private spaces from different customers resolve under this same parent domain, browsers treat them as the same site. As a result, cookies set at the cloudhub.io scope aren’t isolated between customers.

The domain format varies by control plane. For example, applications on the US control plane use .<space-id>.<region>.cloudhub.io, while applications on other control planes add a control-plane suffix, such as .<space-id>.<region>.eu1.cloudhub.io. For more information, see Deploying Apps to Private Spaces.

Hosting websites or other browser-facing applications isn’t supported for the default cloudhub.io domain. To keep browser-facing applications isolated, deploy them to a customer-owned vanity domain by configuring a TLS context with your own domain and DNS records. See Before You Begin to create the DNS records, and DNS Records for the CloudHub 2.0 DNS record formats.
The TLS contexts that you configure for the private space define the domains that are available when deploying apps to the private spaces. See [Configuring Endpoints and Paths for Apps Deployed to a Private Space](https://docs.mulesoft.com/cloudhub-2/ch2-config-endpoints-paths). ## [](#tls-contexts)TLS Contexts Each TLS context includes a keystore and an optional truststore. To [create a TLS context](#create-tls-context): 1. Upload the keystore. 2. Upload the truststore (optional). 3. Accept the default ciphers or select ciphers to add or remove. ### [](#keystore)Keystore A _keystore_ is a repository of security certificates (either authorization certificates or public key certificates), along with their corresponding private keys used, for example, in SSL encryption. The keystore allows communication to your app using custom domains. CloudHub 2.0 supports the following keystore types: PEM (Privacy-Enhanced Mail) A PEM file is a Base64-encoded ASCII file with a `.cer`, `.crt`, or `.pem` extension. For PEM, the keystore consists of: - Public certificate - Private key - Certificate Authority (CA) path file (optional) The keystore in PEM format uses TLS default values. JKS (Java Keystore) A JKS file is a repository for authorization or public key certificates. Use this option to upload a JKS file and use TLS default values. With this option, you can’t change the default values for TLS versions, ciphers, and other TLS configuration options.
If you find any issues with your certificates after uploading a JKS keystore, use a PEM file instead.
### [](#truststore)Truststore A truststore is a set of client certificates that the server checks against to enforce partial client authentication. The optional truststore identifies trusted external clients or certificate authorities (CAs). To enable partial client authentication, configure a truststore. If a truststore is not configured, partial client authentication is disabled. CloudHub 2.0 accepts truststore files in PEM formats. ### [](#dns-targets)DNS Targets Configure a DNS target to allow clients to reach your applications from within or outside of the private network. _Public DNS targets_ allow external clients to reach your applications at custom domains. _Private DNS targets_ can only be reached from inside a private network, or through VPN or transit gateway connections. Use them with internal DNS or allowlists in your connected external networks, so clients in those networks may make requests to your applications. Private DNS targets use private static IP addresses that don’t change during the lifetime of the private space. See [IP Ranges](https://docs.mulesoft.com/cloudhub-2/ch2-networking-guide#ip-ranges). ### [](#ciphers)Ciphers When you add the TLS context, accept the default ciphers or select ciphers to add or remove. CloudHub 2.0 uses these default cipher suites, listed from most secure to lesser secure:
Cipher suite TLS version

TLS_AES_256_GCM_SHA384

TLS 1.3

TLS_CHACHA20_POLY1305_SHA256

TLS 1.3

TLS_AES_128_GCM_SHA256

TLS 1.3

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

TLS 1.2

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

TLS 1.2

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

TLS 1.2

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

TLS 1.2

TLS_RSA_WITH_AES_128_GCM_SHA256

TLS 1.2
You can’t view or change the ciphers on the default `cloudhub.io` TLS context. To inspect the defaults in Runtime Manager, create a custom TLS context and select **Customize Ciphers**. CloudHub 2.0 then displays the default (selected) ciphers. See [Create a TLS Context](#create-tls-context). ## [](#before-you-begin)Before You Begin 1. Generate a keystore: - [PEM](https://docs.mulesoft.com/cloudhub-2/ps-config-ssl-endpoints#pem) - [JKS](https://docs.mulesoft.com/mule-runtime/latest/tls-configuration#generate-a-keystore) 2. Generate a [truststore](https://docs.mulesoft.com/mule-runtime/latest/tls-configuration#truststore-generation) (if you want to enable partial client authentication). 3. Create DNS records for your domains. To enable traffic to reach the apps deployed to the private space using a custom domain: 1. Log in to your domain registrar. Use [Whois](https://www.whois.com/) to look up your registrar. 2. Create a CNAME record in your vanity domain, pointing to your non-wildcard private space FQDN. Your registrar might take up to 24 hours to apply the change. 4. Verify that your account has CloudHub Network Administrator permission, which is required to modify a private space. For information, see [Using Teams to Manage User Permissions](https://docs.mulesoft.com/access-management/teams). ## [](#create-tls-context)Create a TLS Context To create a new TLS context: 1. From Anypoint Platform, select **Runtime Manager** > **Private Spaces**. 2. Click the name of the private space to manage. 3. Click the **Domains & TLS** tab and then click **Create TLS Context**. If you don’t have CloudHub Network Administrator permission, the **Create TLS Context** button is not available. 4. Enter a name for the TLS context. The TLS context name can contain letters, numbers, spaces, and hyphens. 5. **Configure the keystore:** PEM format 1. Select **Upload PEM files**. 2. Click **Choose file** and select a public certificate to upload. Uploading the public certificate displays a summary of the certificate. - Click **…​** > **View Details** to display the keystore details. - Click **…​** > **Delete** to delete the public certificate. 3. Click **Choose file** and select a private key to upload. 4. Enter the key password used to access the private key within the keystore. If the private key is unencrypted (plain text), which is not recommended, leave the **Key Password** field blank. CloudHub 2.0 validates the password against the keystore. 5. If you have a Certificate Authority (CA) path certificate file, click **Choose file** to upload it. JKS format 1. Select **Upload JKS file**. 2. Click **Choose file** and select a keystore file to upload. 3. Enter the password used to access the keystore file. CloudHub 2.0 validates the password against the keystore. 4. Select an alias from the drop-down list. Selecting an alias displays a summary of the alias. Click the **i** to display the alias details. 5. Enter the key password used to access the private key within the keystore. CloudHub 2.0 validates the password against the key. 6. Follow the steps in [Before You Begin](#before-you-begin) to configure DNS. 7. **Configure the truststore (optional):** If you want to use partial client authentication, configure a truststore. The truststore defines the client certificates to use to enable partial client authentication with the configured keystore. Click **Add Certificates** to upload a certificate file (in PEM format). When you upload a PEM file, CloudHub 2.0 displays the client certificates from the truststore file. - Click **Add Certificates** to upload additional certificate files. - Click the information icon (**View Details**) to display the details of an individual client certificate. - Click the trash can icon (**Delete**) to delete an individual client certificate. - If more than four certificates are uploaded, click **Show all x Certificates** to expand the link. 8. **Configure advanced options: (Optional)** If you want to customize ciphers, configure advanced options. 1. Click **Advanced Options** to display the cipher configuration. 2. Select either **Use Default Ciphers** or **Customize Ciphers**. If you choose to customize ciphers, CloudHub 2.0 displays the default (selected) ciphers. - Click **X** to remove a cipher from the list. - Click **Select** to choose a different cipher from the drop-down list. 9. Click **Create TLS Context** or **Cancel** to discard changes. ## [](#view-tls-context-details)View TLS Context Details 1. From Anypoint Platform, select **Runtime Manager** > **Private Spaces**. 2. Click the name of the private space to manage. 3. On the **Domains & TLS** tab, in a custom TLS section, click the TLS context menu (**…​**) and select **View Details**. ## [](#delete-a-tls-context)Delete a TLS Context 1. From Anypoint Platform, select **Runtime Manager** > **Private Spaces**. 2. Click the name of the private space to manage. 3. On the **Domains & TLS** tab, in a custom TLS section, click the TLS context menu (**…​**) and select **Delete**. The **Delete** option appears only if you have CloudHub Network Administrator permission. ## [](#edit-a-tls-context)Edit a TLS Context 1. From Anypoint Platform, select **Runtime Manager** > **Private Spaces**. 2. Click the name of the private space to manage. 3. Click the **Domains & TLS** tab and then click **Edit**. The **Edit** button appears only if you have CloudHub Network Administrator permission. 4. **Configure the keystore:** PEM format 1. Click **Choose file** to replace the current public certificate with a new public certificate. You can’t change the private key or password unless you replace the public certificate. Uploading the public certificate displays a summary of the certificate. Click the information icon (**View Details**) to display the keystore details. 2. Choose a private key to upload. 3. Enter the password used to access the private key within the keystore. If the key password is unencrypted (plain text), which is not recommended, leave the **Key Password** field blank. CloudHub 2.0 validates the password against the keystore. 4. If you have a Certificate Authority (CA) path certificate file, click **Choose file** to upload it. You can remove and add a CA path certificate without replacing the public certificate. JKS format 1. Click **Choose file** to replace the current keystore file with a new keystore file. 2. Enter the password used to access the keystore file. CloudHub 2.0 validates the password against the keystore. 3. Select an alias from the drop-down list. You can select a different alias without replacing the keystore file. Selecting an alias displays a summary of the alias. Click the information icon (**View Details**) to display the alias details. 4. Enter the key password used to access the private key within the keystore. CloudHub 2.0 validates the password against the key. 5. **Configure the truststore: (Optional)** If you want to use partial client authentication, configure a truststore. The truststore defines the client certificates to use to enable partial client authentication with the configured keystore. Click **Add Certificates** to upload a certificate file (in PEM format). When you upload a PEM file, CloudHub 2.0 displays the client certificates from the truststore file. - Click **Add Certificates** to upload additional certificate files. - Click the information icon (**View Details**) to display the details of an individual client certificate. - Click the trash can icon (**Delete**) to delete an individual client certificate. 6. **Configure advanced options: (Optional)** If you want to customize ciphers, configure advanced options. 1. Click **Advanced options** to display the cipher configuration. 2. Select either **Use Default Ciphers** or **Customize Ciphers**. If you choose to customize ciphers, CloudHub 2.0 displays the default (selected) ciphers. - Click **X** to remove a cipher from the list. - Click **Select a cipher to add** to choose a different cipher. 7. Click **Update TLS Context** or **Cancel** to discard changes. Add the LetsEncrypt root to your truststore if you want the client to trust the `cloudhub.io` certificates. ## [](#see-also)See Also - [Deploying Apps to Private Spaces](https://docs.mulesoft.com/cloudhub-2/ch2-deploy-private-space) - [Configuring Endpoints and Paths for Apps Deployed to a Private Space](https://docs.mulesoft.com/cloudhub-2/ch2-config-endpoints-paths) - [Configure TLS with Keystores and Truststores](https://docs.mulesoft.com/mule-runtime/latest/tls-configuration)