---
schema_version: "1"
id: ab343344a222f9269336a0db73376c7990a2a3e5e70689f48b04be8b89306d03
title: Configure SSL Endpoints and Certificates
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cloudhub/lb-ssl-endpoints.md
canonical_url: https://docs.mulesoft.com/cloudhub/lb-ssl-endpoints
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 5da71609c04f87b7d4f4cc33411d834578718bfb33feac7a3cd147597885a733
description: MuleSoft Documentation Site
latest: true
---
---
product: CloudHub
---

# Configure SSL Endpoints and Certificates

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

A dedicated load balancer must have at least one certificate associated with it. To configure an SSL
endpoint for your load balancer to serve to clients, provide a certificate and private key pair for
your load balancer.

A load balancer can have multiple and independent SSL endpoints, each identified by its server
certificate common name.

## Requirements

To associate an SSL endpoint, you must provide:

- An unencrypted, PEM-encoded (Privacy-Enhanced Mail) certificate file.

- A second file containing the private key of your PEM certificate.

  The private key file must be _passphraseless_.

## Create a Certificate File and Private Key with the openssl Command

You can create both an unencrypted, PEM-encoded certificate file and a private key using `openssl`.

For example, to create a self-signed certificate and corresponding private key:

1.  Enter:

    openssl req -newkey rsa:2048 -nodes -keyout example-com-private.pem -x509 -days 3000 -out
    example-com-crt.pem

2.  When prompted, enter the certificate information.

    This command creates two `.pem` files:

    example-com-crt.pem example-com-private.pem

    You upload these `.pem` files in Runtime Manager or pass them on the command line when you add
    an SSL endpoint to the load balancer.

Alternatively, you can pass a certificate information configuration file to the `openssl` command
using the `-config` option.

For example, this certificate configuration file named `example-com.cfg` defines the DNS domain
`example.com` that includes some SANs (Subject Alternate Names) for Mule applications
`app1.example.com` and `app2.example.com`.

\[ req \] default\_bits = 2048 distinguished\_name = req\_distinguished\_name req\_extensions =
req\_ext prompt = no \[ req\_distinguished\_name \] countryName = US stateOrProvinceName =
California localityName = San Francisco organizationName = MuleSoft commonName = example.com

\[ req\_ext \] subjectAltName = @alt\_names \[alt\_names\] DNS.1 = app1.example.com DNS.2 =
app2.example.com

Run the following command:

openssl req -newkey rsa:2048 -nodes -keyout example-com-private.pem -x509 -days 3000 -out
example-com-crt.pem -config example-com.cfg

### Create a Wildcard Certificate

You might want to create a wildcard certificate to support subdomain requests, for example, to
support `example.com` and include `app1.example.com` and `app2.example.com`, as well as any future
subdomain names.

To create a wildcard certificate that maps any subdomain name to `example.com`:

1.  Create a file that includes this configuration:

    \[ req \] default\_bits = 2048 distinguished\_name = req\_distinguished\_name prompt = no \[
    req\_distinguished\_name \] countryName = US stateOrProvinceName = California localityName = San
    Francisco organizationName = MuleSoft commonName = \*.example.com

2.  Pass the certificate configuration file in an `openssl` command:

    openssl req -newkey rsa:2048 -nodes -keyout example-com-private.pem -x509 -days 3000 -out
    example-com-crt.pem -config example-com.cfg

3.  Decrypt the private key using `openssl`:

    openssl rsa -in example-com-private.pem -out example-com-private-decrypted.pem

## Configure Certificates for Production

Typically, in a production environment, your certificate is signed by a valid Certificate Authority
(CA). Each SSL endpoint can have multiple CA certificates and CRLs (Certificate Revocation Lists).
You must provide each of these certificates in a single unencrypted, PEM-encoded file. Ordering is
not important for independent CA certificates, but certificates in a chain of trust must be
concatenated.

## See Also

- [Add Certificates](https://docs.mulesoft.com/cloudhub/lb-cert-upload)

- [Certificate Validation](https://docs.mulesoft.com/cloudhub/lb-cert-validation)

- [Allowlists](https://docs.mulesoft.com/cloudhub/lb-allowlists)

- [Mapping Rules](https://docs.mulesoft.com/cloudhub/lb-mapping-rules)