Loading

CloudHub 2.0 Manage mTLS Certificates Without an Application Redeploy

Veröffentlichungsdatum: Jul 29, 2026
Beschreibung
ISSUE:
Organizations with a frequent certificate rotation policy (for example, certificates that expire and renew every 30-90 days) want to centralize and externalize TLS certificate management on CloudHub 2.0, so that a certificate renewal does not require rebuilding and redeploying every application that uses it.

CAUSE:
CloudHub 2.0 draws a distinction between inbound and outbound TLS certificate handling:
- INBOUND TLS (the certificate presented to callers of your API) can be centralized at the Private Space level using a Private Space TLS Context. This certificate can be rotated independently of any application and does not require an application redeploy.
- OUTBOUND or CLIENT mTLS certificates (used by your application to authenticate itself as a client to another system, or presented by your app to consumers making mTLS calls to it) are packaged inside the application artifact as a keystore or truststore. This is read once at application startup. CloudHub 2.0 does not currently support overriding the default JVM truststore with an externally-mounted, hot-swappable custom truststore for this purpose.
Lösung

Certificates that terminate inbound traffic into your apps can be centralized at the Private Space and rotated with no redeployment.
Certificates your apps present on outbound calls cannot currently be rotated on CloudHub 2.0 without a rebuild and redeploy, since the keystore is packaged with the application and read once at startup.

INBOUND HTTPS INTO YOUR APPLICATIONS
Note: this option requires your apps to be deployed to a Private Space
You can move TLS termination up to the Private Space instead of handling it inside each app. A Private Space TLS Context lets you replace the keystore directly from Runtime Manager, with no rebuild and no redeployment, shared by every app on that Private Space. You update the certificate once per renewal and new connections pick it up, with no per-app Change Request:
Configuring Domains and Certificates (TLS Context) for a Private Space: https://docs.mulesoft.com/cloudhub-2/ps-config-domains

OUTBOUND MUTUAL TLS FROM YOUR APPS
For certificates your apps present when calling out (the HTTP Request connector), CloudHub 2.0 has no native way to hot-swap a .jks at runtime without a redeploy. This is a platform boundary.



Nummer des Knowledge-Artikels

005390242

 
Laden
Salesforce Help | Article