---
schema_version: "1"
id: 8c3b7c3410493d5384ffeb51a7d16bf3b169460a9b4d68ff3874b528eddc788a
title: Configuring Security for Anypoint Platform PCE
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/private-cloud/latest/access-management-security.md
canonical_url: https://docs.mulesoft.com/private-cloud/latest/access-management-security
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 8609bd9800b91371334398396eab09793e0e1a304912a3f57a471fa2cd26f296
description: MuleSoft Documentation Site
release: "4.3"
latest: true
---
---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Configuring Security for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To use Anypoint Platform Private Cloud Edition (Anypoint Platform PCE), you must supply TLS
credentials. Upload a certificate via the Anypoint Platform UI under **Access Management**, and
configure the platform to use this certificate to secure communications. Ensure that every machine
connected to the platform, including Mule runtime engine (Mule), trusts this certificate.
Additionally, you have the option to specify custom ciphers and Diffie-Hellman (DH) groups for the
key exchange method if needed.

When you replace or change the certificate, Anypoint Platform restarts the nginx server.

![Certificate and Private Key configuration under the Security tab in Access Management](/mulesoft/current/en-us/private-cloud/latest/_images/on-prem-features-5f98d.png)

To configure the security, follow these steps:

1.  Create a certificate.

    Generate your certificate using a tool like OpenSSL. To be compatible with Anypoint Platform,
    ensure your certificate is in an `nginx` friendly format. The certificate must include the
    domain name of your installation as both the Common Name (CN) and the Subject Alternative Name
    (SAN).

2.  From Anypoint Platform, select **Access Management**.

3.  Select **Security**.

4.  Under **Certificate**, select **Browse** to select the certificate on your local system.

5.  Under **Key**, select **Browse** to select the private key for your certificate.

6.  For additional security, you can upload your own cipher and Diffie-Hellman group file.

    Note that this step is optional.

    1.  Deselect **Use default ciphers and DH Group**.

    2.  Enter a set of ciphers from the list of valid NGINX ciphers. If you are using Open SSL, you
        can view this list by running the `openssl ciphers` command. The cipher you enter must be in
        an `nginx` compatible format, for example:

        ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384

    3.  Generate `dhparam.pem` (the Diffie-Hellman group file) using the following `openssl`
        command:

        openssl dhparam 2048 -out dhparam.pem

    4.  Upload the `dhparam.pem` file from your system.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/config-workflow)