---
schema_version: "1"
id: 0c96d63146add324e62dc0b2a03a48d828fd91dd682191c02d91f617eb507a4a
title: Configuring Security for Anypoint Platform PCE
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/private-cloud/4.2/access-management-security.md
canonical_url: https://docs.mulesoft.com/private-cloud/4.2/access-management-security
source_site: docs.mulesoft.com
content_type: documentation
content_hash: c4193ee503b4c436fddb050fc7c8dd733f72df40a2f29fbf5457ebef656392f3
description: MuleSoft Documentation Site
release: "4.2"
latest: false
---
---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Configuring Security for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To use Anypoint Platform Private Cloud Edition (Anypoint Platform PCE), you must supply TLS
credentials. Upload a certificate via the Anypoint Platform UI under **Access Management**, and
configure the platform to use this certificate to secure communications. Ensure that every machine
connected to the platform, including Mule runtime engine (Mule), trusts this certificate.
Additionally, you have the option to specify custom ciphers and Diffie-Hellman (DH) groups for the
key exchange method if needed.

When you replace or change the certificate, Anypoint Platform restarts the nginx server.

![Certificate and Private Key configuration under the Security tab in Access Management](/mulesoft/current/en-us/private-cloud/4.2/_images/on-prem-features-5f98d.png)

To configure the security, follow these steps:

1.  Create a certificate.

    Generate your certificate using a tool like OpenSSL. To be compatible with Anypoint Platform,
    ensure your certificate is in an `nginx` friendly format. The certificate must include the
    domain name of your installation as both the Common Name (CN) and the Subject Alternative Name
    (SAN).

2.  From Anypoint Platform, select **Access Management**.

3.  Select **Security**.

4.  Under **Certificate**, select **Browse** to select the certificate on your local system.

5.  Under **Key**, select **Browse** to select the private key for your certificate.

6.  For additional security, you can upload your own cipher and Diffie-Hellman group file.

    Note that this step is optional.

    1.  Deselect **Use default ciphers and DH Group**.

    2.  Enter a set of ciphers from the list of valid NGINX ciphers. If you are using Open SSL, you
        can view this list by running the `openssl ciphers` command. The cipher you enter must be in
        an `nginx` compatible format, for example:

        ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384

    3.  Generate `dhparam.pem` (the Diffie-Hellman group file) using the following `openssl`
        command:

        openssl dhparam 2048 -out dhparam.pem

    4.  Upload the `dhparam.pem` file from your system.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/config-workflow)