Topik ini menjelaskan cara mengaktifkan TLS satu arah dan mTLS di ingressgateway.
Mengonfigurasi TLS satu arah
Gunakan TLS satu arah untuk mengamankan endpoint proxy API di gateway masuk. Untuk mengaktifkan TLS satu arah, Anda mengonfigurasi traffic masuk dengan pasangan kunci/sertifikat TLS atau dengan Secret Kubernetes, seperti yang dijelaskan dalam opsi berikut.
Opsi 1: pasangan kunci/sertifikat
Berikan file kunci dan sertifikat SSL di properti virtualhosts dalam file penggantian Anda:
Dengan $ENVIRONMENT_GROUP_NAME adalah nama grup lingkungan dengan
alias host yang sesuai, dan $CERT_FILE dan $KEY_FILE adalah file kunci dan sertifikat TLS. Lihat Membuat sertifikat TLS.
Konfigurasikan properti virtualhosts di file penggantian Anda:
virtualhosts:
- name: $ENVIRONMENT_GROUP_NAME
tlsMode: SIMPLE # Note: SIMPLE is the default, so it is optional.
sslSecret: $SECRET_NAME
Mengonfigurasi mTLS
Sebagai ganti TLS satu arah, Anda dapat mengonfigurasi
mTLS di gateway
masuk. Ada dua opsi untuk mengonfigurasi mTLS, seperti yang dijelaskan di bawah.
Opsi 1: pasangan kunci/sertifikat dan file CA
Berikan data sertifikat TLS yang berisi sertifikat Certificate Authority:
Dengan $ENVIRONMENT_GROUP_NAME adalah nama grup lingkungan dengan
alias host yang sesuai, $CA_FILE menentukan data sertifikat TLS (file paket CA)
yang berisi sertifikat Certificate Authority, dan $CERT_FILE dan
$KEY_FILE adalah file kunci dan sertifikat TLS. Lihat Membuat sertifikat TLS.
Opsi 2: Secret Kubernetes
Buat dua Secret Kubernetes. Secret pertama adalah untuk pasangan kunci/sertifikat SSL dan yang kedua adalah
untuk CA. Kemudian, tambahkan ke file penggantian Anda.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-03 UTC."],[[["\u003cp\u003eOne-way TLS can be enabled on the ingress gateway to secure API proxy endpoints using either a key/cert pair or a Kubernetes Secret, specified in the \u003ccode\u003evirtualhosts\u003c/code\u003e property of the overrides file.\u003c/p\u003e\n"],["\u003cp\u003emTLS can be configured on the ingress gateway using either a key/cert pair along with a CA file, or two separate Kubernetes Secrets (one for the SSL cert/key pair, and one for the CA), in the overrides file.\u003c/p\u003e\n"],["\u003cp\u003eFor both one-way TLS and mTLS, the key/cert pair option requires the \u003ccode\u003esslCertPath\u003c/code\u003e and \u003ccode\u003esslKeyPath\u003c/code\u003e parameters, while the mTLS also requires the \u003ccode\u003ecaCertPath\u003c/code\u003e, and when using Kubernetes secrets, you need to use \u003ccode\u003esslSecret\u003c/code\u003e to reference the corresponding secret name.\u003c/p\u003e\n"],["\u003cp\u003eWhen configuring mTLS, you must specify \u003ccode\u003etlsMode: MUTUAL\u003c/code\u003e in the \u003ccode\u003evirtualhosts\u003c/code\u003e section of your overrides file.\u003c/p\u003e\n"]]],[],null,["# Configuring TLS and mTLS on the ingress gateway\n\n| You are currently viewing version 1.13 of the Apigee hybrid documentation. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic explains how to enable one-way TLS and mTLS on the ingressgateway.\n\nConfiguring one-way TLS\n-----------------------\n\nUse one-way TLS to secure API proxy endpoints on the ingress gateway. To enable\none-way TLS, you configure the ingress with TLS cert/key pairs or with a Kubernetes\nSecret, as explained in the following options.\n\n### Option 1: key/cert pair\n\n\nProvide SSL cert and key files in the `virtualhosts` property in your overrides file: \n\n```scdoc\nvirtualhosts:\n - name: $ENVIRONMENT_GROUP_NAME\n sslCertPath: \"$CERT_FILE\"\n sslKeyPath: \"$KEY_FILE\"\n```\n\n\nWhere \u003cvar translate=\"no\"\u003e$ENVIRONMENT_GROUP_NAME\u003c/var\u003e is the name of an environment group with\ncorresponding host aliases, and \u003cvar translate=\"no\"\u003e$CERT_FILE\u003c/var\u003e and \u003cvar translate=\"no\"\u003e$KEY_FILE\u003c/var\u003e are TLS key and certificate\nfiles. See [Create TLS certificates](/apigee/docs/hybrid/v1.13/install-create-tls-certificates).\n| **Tip:** For security purposes, it is best practice to have a separate TLS cert/key pair for each virtual host. If you are using a Subject Alternative Name (SAN ) certificate, this TLS cert/key pair should be used on one virtual host that is shared across the domain.\n\n### Option 2: Kubernetes Secret\n\n\nCreate a [Kubernetes\nSecret](https://kubernetes.io/docs/concepts/configuration/secret/) and add it to your overrides file.\n\n1. Create the Secret in the **apigee** namespace: \n\n ```\n kubectl create -n APIGEE_NAMESPACE secret generic $SECRET_NAME \\\n --from-file=key=$KEY_FILE \\\n --from-file=cert=$CERT_FILE\n ```\n2. Configure the `virtualhosts` property in your overrides file: \n\n ```scdoc\n virtualhosts:\n - name: $ENVIRONMENT_GROUP_NAME\n tlsMode: SIMPLE # Note: SIMPLE is the default, so it is optional.\n sslSecret: $SECRET_NAME\n ```\n\nConfiguring mTLS\n----------------\n\n\nInstead of one-way TLS, you can configure\n[mTLS](https://en.wikipedia.org/wiki/Mutual_authentication) on the\ningress gateway. There are two options for configuring mTLS, as explained below.\n\n### Option 1: key/cert pair and CA file\n\n\nProvide TLS\ncertificate data containing Certificate Authority certificates: \n\n```scdoc\nvirtualhosts:\n - name: $ENVIRONMENT_GROUP_NAME\n tlsMode: MUTUAL\n caCertPath: \"$CA_FILE\"\n sslCertPath: \"$CERT_FILE\"\n sslKeyPath: \"$KEY_FILE\"\n```\n\n\nWhere \u003cvar translate=\"no\"\u003e$ENVIRONMENT_GROUP_NAME\u003c/var\u003e is the name of an environment group with\ncorresponding host aliases, \u003cvar translate=\"no\"\u003e$CA_FILE\u003c/var\u003e specifies TLS certificate data (CA bundle file)\ncontaining Certificate Authority certificates, and \u003cvar translate=\"no\"\u003e$CERT_FILE\u003c/var\u003e and\n\u003cvar translate=\"no\"\u003e$KEY_FILE\u003c/var\u003e are TLS key and certificate\nfiles. See [Create TLS certificates](/apigee/docs/hybrid/v1.13/install-create-tls-certificates).\n\n### Option 2: Kubernetes Secrets\n\nCreate two Kubernetes Secrets. The first secret is for the SSL cert/key pair and the second is\nfor the CA. Then, add them to your overrides file.\n\n1. Create two Kubernetes secrets the **apigee** namespace: \n\n ```\n kubectl create -n APIGEE_NAMESPACE secret generic $SECRET_NAME \\\n --from-file=key=$KEY_FILE \\\n --from-file=cert=$CERT_FILE\n ```\n2. Create a secret for the CA: \n\n ```\n kubectl create -n APIGEE_NAMESPACE secret generic $SECRET_NAME-cacert \\\n --from-file=cacert=$CA_FILE\n ```\n3. Configure the `virtualhosts` property in your overrides file: \n\n ```scdoc\n virtualhosts:\n - name: $ENVIRONMENT_GROUP_NAME\n tlsMode: MUTUAL # Note: Be sure to specify MUTUAL\n sslSecret: $SECRET_NAME\n ```"]]
