---
schema_version: "1"
id: 256cb1ca5c38c475b3bb9c17e423fe5a6d07feac43c8bb8e5af06755190affce
title: Configuring TLS for Outgoing Policy Requests
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.12/policies-tls-configuration.md
canonical_url: https://docs.mulesoft.com/gateway/1.12/policies-tls-configuration
source_site: docs.mulesoft.com
content_type: documentation
content_hash: a4324db1fab442b23e04e0d0d42a2b15182c01ef820a13a9a3193d5fdc185ed8
description: MuleSoft Documentation Site
release: "1.12"
latest: false
---
---
product: Omni Gateway
version: 1.12
keywords: policy, custom
---

# Configuring TLS for Outgoing Policy Requests

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Some Flex Gateway policies make outgoing requests to HTTP and gRPC upstream services. For example,
the [OAuth 2.0 Token Introspection Policy](https://docs.mulesoft.com/gateway/1.12/policies-included-oauth-token-introspection) sends token
validation requests to an OAuth 2.0 service, and the
[External Authorization Policy](https://docs.mulesoft.com/gateway/1.12/policies-included-external-authorization) forwards incoming client
requests to an authorization service.

By default, Managed and Self-Managed Flex Gateways protect these connections with a default TLS
Context. The default TLS context is not mTLS and uses the default ciphers listed in
[TLS Cipher Support on Flex Gateway](#local-support).

To override the default TLS context, configure a custom default TLS context for all outgoing
requests from policies. You can’t configure a custom default TLS context for Managed Flex Gateway.

## Configure a TLS Context for Self-Managed Gateways

For both local and connected mode, use a YAML configuration file to configure TLS between a policy
and an upstream service:

apiVersion: gateway.mulesoft.com/v1alpha1 kind: Configuration metadata: name: default-tls spec:
defaultTLS: outboundPolicyCalls: skipValidation: <boolean> // OPTIONAL trustedCA: <string> #
OPTIONAL, defaults to the CA of operating systems certificate: // OPTIONAL key: <string> // OPTIONAL
crt: <string> // OPTIONAL alpn: <array> // OPTIONAL minversion: <string> // OPTIONAL maxversion:
<string> // OPTIONAL ciphers: <array> // OPTIONAL

Not including optional parameters in your configuration file applies the parameters default values
to your TLS context.

When configuring the `ciphers` parameter, ensure that your API upstream supports the listed ciphers.
For the supported ciphers, see [TLS Cipher Support on Flex Gateway](#local-support).

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required or Optional</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>skipValidation</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>false</p></div></div></td><td><div><div><p>If true, the upstream certificate is not validated.</p></div></div></td></tr><tr><td><div><div><p><code>trustedCA</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>The CA used to validate the upstream server certificate. If no trusted CA is provided, the policy uses the default OS CA.</p></div></div></td></tr><tr><td><div><div><p><code>certificate</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>The client certificate to present for mTLS. To comply with security standards, all certificates must be 2048 bits or longer.</p></div></div></td></tr><tr><td><div><div><p><code>certificate.key</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>The private key part of the certificate.</p></div></div></td></tr><tr><td><div><div><p><code>certificate.crt</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>N/A</p></div></div></td><td><div><div><p>The public key part of the certificate.</p></div></div></td></tr><tr><td><div><div><p><code>alpn</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>h2</code> and <code>http/1.1</code></p></div></div></td><td><div><div><p>A prioritized list of supported application level protocols; for example, h2, http/1.1, and so forth.</p></div></div></td></tr><tr><td><div><div><p><code>minversion</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>1.2</code></p></div></div></td><td><div><div><p>The minimum TLS version allowed.</p></div></div></td></tr><tr><td><div><div><p><code>maxversion</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p><code>1.3</code></p></div></div></td><td><div><div><p>The maximum TLS version allowed.</p></div></div></td></tr><tr><td><div><div><p><code>ciphers</code></p></div></div></td><td><div><div><p>Optional</p></div></div></td><td><div><div><p>For the default and other supported ciphers, see <a href="#local-support">TLS Cipher Support on Flex Gateway</a>.</p></div></div></td><td><div><div><p>A list of supported TLS ciphers (IANA format).</p></div></div></td></tr></tbody></table>

## TLS Cipher Support on Flex Gateway

Flex can support a range of TLS Versions from TLS 1.2 to TLS 1.3, and you can also customize some of
the ciphers to support.

You cannot customize the list of TLS 1.3 Ciphers. If you support TLS 1.3, the TLS 1.3 default
ciphers are all supported regardless of the ciphers listed in the configuration file. If you don’t
support TLS 1.3, these ciphers are not included.

For TLS 1.2, listing any ciphers overides the TLS 1.2 default ciphers. If you want to list ciphers
besides the default TLS 1.2 Ciphers, you must list every cipher to support including the default
ciphers you want to support. Excluding default ciphers from your list of supported ciphers means you
do not support those ciphers. If you wish to only support the default ciphers, you can leave the
cipher list blank. Listing ciphers does not affect the default TLS 1.3 cipher.

> [!IMPORTANT] For outbound TLS Context, ensure that your upstream service supports the selected
> ciphers and versions.

### Flex Gateway Supported Ciphers

Flex Gateway supports the following TLS Ciphers in Connected Mode and Local Mode:

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Cipher</th><th>TLS Version</th><th>Default</th><th>Advice</th></tr></thead><tbody><tr><td><div><div><p>TLS_AES_128_GCM_SHA256</p></div></div></td><td><div><div><p>1.3</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Secure</p></div></div></td></tr><tr><td><div><div><p>TLS_AES_256_GCM_SHA384</p></div></div></td><td><div><div><p>1.3</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Secure</p></div></div></td></tr><tr><td><div><div><p>TLS_CHACHA20_POLY1305_SHA256</p></div></div></td><td><div><div><p>1.3</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Secure</p></div></div></td></tr><tr><td><div><div><p>TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Recommended</p></div></div></td></tr><tr><td><div><div><p>TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Recommended</p></div></div></td></tr><tr><td><div><div><p>TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Recommended</p></div></div></td></tr><tr><td><div><div><p>TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Recommended</p></div></div></td></tr><tr><td><div><div><p>TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Secure</p></div></div></td></tr><tr><td><div><div><p>TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Secure</p></div></div></td></tr><tr><td><div><div><p>TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>Yes</p></div></div></td><td><div><div><p>Secure</p></div></div></td></tr><tr><td><div><div><p>TLS_RSA_WITH_AES_128_GCM_SHA256</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Weak</p></div></div></td></tr><tr><td><div><div><p>TLS_RSA_WITH_AES_256_GCM_SHA384</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Weak</p></div></div></td></tr><tr><td><div><div><p>TLS_RSA_WITH_AES_128_CBC_SHA</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Weak</p></div></div></td></tr><tr><td><div><div><p>TLS_RSA_WITH_AES_256_CBC_SHA</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Weak</p></div></div></td></tr><tr><td><div><div><p>TLS_PSK_WITH_AES_128_CBC_SHA</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Weak</p></div></div></td></tr><tr><td><div><div><p>TLS_PSK_WITH_AES_256_CBC_SHA</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Weak</p></div></div></td></tr><tr><td><div><div><p>TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Weak</p></div></div></td></tr><tr><td><div><div><p>TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Weak</p></div></div></td></tr><tr><td><div><div><p>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Weak</p></div></div></td></tr><tr><td><div><div><p>TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Weak</p></div></div></td></tr><tr><td><div><div><p>TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Weak</p></div></div></td></tr><tr><td><div><div><p>TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA</p></div></div></td><td><div><div><p>1.2</p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>Weak</p></div></div></td></tr></tbody></table>