---
schema_version: "1"
id: 318188ae62cd15a4e0eef66db6cc14c4c079c0d74077e87abd676c6ef9aab2cd
title: Configuring Security for Anypoint Platform PCE
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/private-cloud/4.1/access-management-security.md
canonical_url: https://docs.mulesoft.com/private-cloud/4.1/access-management-security
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 80c1b3c639a68f771c82fdfad6b5560d900f44fd03e188da4bd48b8441011c7a
description: MuleSoft Documentation Site
release: "4.1"
latest: false
---
---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Configuring Security for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To use Anypoint Platform Private Cloud Edition (Anypoint Platform PCE), you must supply TLS
credentials. Upload a certificate via the Anypoint Platform UI under **Access Management**, and
configure the platform to use this certificate to secure communications. Ensure that every machine
connected to the platform, including Mule runtime engine (Mule), trusts this certificate.
Additionally, you have the option to specify custom ciphers and Diffie-Hellman (DH) groups for the
key exchange method if needed.

When you replace or change the certificate, Anypoint Platform restarts the nginx server.

![Certificate and Private Key configuration under the Security tab in Access Management](/mulesoft/current/en-us/private-cloud/4.1/_images/on-prem-features-5f98d.png)

To configure the security, follow these steps:

1.  Create a certificate.

    Generate your certificate using a tool like OpenSSL. To be compatible with Anypoint Platform,
    ensure your certificate is in an `nginx` friendly format. The certificate must include the
    domain name of your installation as both the Common Name (CN) and the Subject Alternative Name
    (SAN).

2.  From Anypoint Platform, select **Access Management**.

3.  Select **Security**.

4.  Under **Certificate**, select **Browse** to select the certificate on your local system.

5.  Under **Key**, select **Browse** to select the private key for your certificate.

6.  For additional security, you can upload your own cipher and Diffie-Hellman group file.

    Note that this step is optional.

    1.  Deselect **Use default ciphers and DH Group**.

    2.  Enter a set of ciphers from the list of valid NGINX ciphers. If you are using Open SSL, you
        can view this list by running the `openssl ciphers` command. The cipher you enter must be in
        an `nginx` compatible format, for example:

        ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384

    3.  Generate `dhparam.pem` (the Diffie-Hellman group file) using the following `openssl`
        command:

        openssl dhparam 2048 -out dhparam.pem

    4.  Upload the `dhparam.pem` file from your system.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/config-workflow)