---
schema_version: "1"
id: 553b2eb51d451bc38bf57f71d0d674d7f76a49f666d97ec787294d3c496fc30b
title: Configure SSL Endpoints and Certificates
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cloudhub-2/ps-config-ssl-endpoints.md
canonical_url: https://docs.mulesoft.com/cloudhub-2/ps-config-ssl-endpoints
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 5323b8542f68d58284e931b70c9ee8bc933d95ce253c66b66649b0ee208b45f9
description: MuleSoft Documentation Site
latest: true
---
---
product: CloudHub 2.0
---

# Configure SSL Endpoints and Certificates

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

While you do not have to manage load balancers manually in CloudHub 2.0, each private space must
have at least one certificate associated with it. To configure an SSL endpoint for your load
balancer to serve to clients, provide a certificate and private key pair for your load balancer.

A load balancer can have multiple and independent SSL endpoints, each identified by its server
certificate common name.

## Before You Begin

To associate an SSL endpoint, you must provide:

- An encrypted, PEM-encoded (Privacy-Enhanced Mail) certificate file.

- A second file containing the private key of your PEM certificate.

## Create a Certificate File and Private Key with the openssl Command

You can create both an encrypted, PEM-encoded certificate file and a private key using `openssl`.

For example, to create a self-signed certificate and corresponding private key:

1.  Enter:

    openssl req -newkey rsa:2048 -keyout example-com-private-key.pem -x509 -days 3000 -out
    example-com-crt.pem -passout pass:examplePassword

2.  When prompted, enter the certificate information.

    This command creates two `.pem` files:

    example-com-crt.pem example-com-private.pem

    You upload these `.pem` files in Runtime Manager or pass them on the command line when you add
    an SSL endpoint to the load balancer.

Alternatively, you can pass a certificate information configuration file to the `openssl` command
using the `-config` option.

For example, this certificate configuration file named `example-com.cfg` defines the DNS domain
`example.com` that includes some SANs (Subject Alternate Names) for Mule applications
`app1.example.com` and `app2.example.com`.

\[ req \] default\_bits = 2048 distinguished\_name = req\_distinguished\_name req\_extensions =
req\_ext prompt = no \[ req\_distinguished\_name \] countryName = US stateOrProvinceName =
California localityName = San Francisco organizationName = MuleSoft commonName = example.com

\[ req\_ext \] subjectAltName = @alt\_names \[alt\_names\] DNS.1 = app1.example.com DNS.2 =
app2.example.com

Run the following command:

openssl req -newkey rsa:2048 -nodes -keyout example-com-private.pem -x509 -days 3000 -out
example-com-crt.pem -config example-com.cfg

### Create a Wildcard Certificate

You might want to create a wildcard certificate to support subdomain requests, for example, to
support `example.com` and include `app1.example.com` and `app2.example.com`, as well as any future
subdomain names.

To create a wildcard certificate that maps any subdomain name to `example.com`:

1.  Create a file that includes this configuration:

    \[ req \] default\_bits = 2048 distinguished\_name = req\_distinguished\_name prompt = no \[
    req\_distinguished\_name \] countryName = US stateOrProvinceName = California localityName = San
    Francisco organizationName = MuleSoft commonName = \*.example.com

2.  Pass the certificate configuration file in an `openssl` command:

    openssl req -newkey rsa:2048 -nodes -keyout example-com-private.pem -x509 -days 3000 -out
    example-com-crt.pem -config example-com.cfg

3.  Decrypt the private key using `openssl`:

    openssl rsa -in example-com-private.pem -out example-com-private-decrypted.pem

## Configure Certificates for Production

Typically, in a production environment, your certificate is signed by a valid Certificate Authority
(CA). Each SSL endpoint can have multiple CA certificates and CRLs (Certificate Revocation Lists).
You must provide each of these certificates in a single encrypted, PEM-encoded file. Ordering is not
important for independent CA certificates, but certificates in a chain of trust must be
concatenated.