---
schema_version: "1"
id: 136e9f2f6101459e30719637a7a765e1aa537e16d0c41ce50ceeae4f27670e25
title: Configuring Security for Anypoint Platform PCE
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/private-cloud/4.0/access-management-security.md
canonical_url: https://docs.mulesoft.com/private-cloud/4.0/access-management-security
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 8b896554e5c2bfb51bf9c834ac8149c3cf09c335b73f6face36ec9fe380a4010
description: MuleSoft Documentation Site
release: "4.0"
latest: false
---
---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Configuring Security for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To use Anypoint Platform Private Cloud Edition (Anypoint Platform PCE), you must supply TLS
credentials. Upload a certificate via the Anypoint Platform UI under **Access Management**, and
configure the platform to use this certificate to secure communications. Ensure that every machine
connected to the platform, including Mule runtime engine (Mule), trusts this certificate.
Additionally, you have the option to specify custom ciphers and Diffie-Hellman (DH) groups for the
key exchange method if needed.

When you replace or change the certificate, Anypoint Platform restarts the nginx server.

![Certificate and Private Key configuration under the Security tab in Access Management](/mulesoft/current/en-us/private-cloud/4.0/_images/on-prem-features-5f98d.png)

To configure the security, follow these steps:

1.  Create a certificate.

    Generate your certificate using a tool like OpenSSL. To be compatible with Anypoint Platform,
    ensure your certificate is in an `nginx` friendly format. The certificate must include the
    domain name of your installation as both the Common Name (CN) and the Subject Alternative Name
    (SAN).

2.  From Anypoint Platform, select **Access Management**.

3.  Select **Security**.

4.  Under **Certificate**, select **Browse** to select the certificate on your local system.

5.  Under **Key**, select **Browse** to select the private key for your certificate.

6.  For additional security, you can upload your own cipher and Diffie-Hellman group file.

    Note that this step is optional.

    1.  Deselect **Use default ciphers and DH Group**.

    2.  Enter a set of ciphers from the list of valid NGINX ciphers. If you are using Open SSL, you
        can view this list by running the `openssl ciphers` command. The cipher you enter must be in
        an `nginx` compatible format, for example:

        ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384

    3.  Generate `dhparam.pem` (the Diffie-Hellman group file) using the following `openssl`
        command:

        openssl dhparam 2048 -out dhparam.pem

    4.  Upload the `dhparam.pem` file from your system.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/config-workflow)