Este tópico explica como ativar o TLS unidirecional e mTLS no gateway de entrada .
Como configurar o TLS unidirecional
Use o TLS unidirecional para proteger os endpoints de proxy de API no gateway de entrada. Para ativar o TLS unidirecional, configure a entrada com pares de certificado/chave TLS ou com um secret do Kubernetes, conforme explicado nas opções a seguir.
Opção 1: par de chave/certificado
Forneça arquivos de certificado e chave SSL na propriedade virtualhosts no seu arquivo de modificações:
Em que $ENVIRONMENT_GROUP_NAME é o nome de um grupo de ambientes com aliases de host correspondentes, e $CERT_FILE e $KEY_FILE são arquivos de chave e certificado TLS. Consulte Criar certificados TLS.
Configure a propriedade virtualhosts no arquivo de modificações:
virtualhosts:
- name: $ENVIRONMENT_GROUP_NAME
tlsMode: SIMPLE # Note: SIMPLE is the default, so it is optional.
sslSecret: $SECRET_NAME
Como configurar o mTLS
Em vez de TLS de mão única, você pode configurar mTLS no gateway de entrada. Há duas opções para configurar o mTLS, conforme explicado abaixo.
Opção 1: par de chave/certificado e arquivo CA
Forneça um certificado da autoridade de certificação (CA, na sigla em inglês) com o certificado SSL e os arquivos de chave na propriedade virtualhosts no arquivo de modificação:
Em que $ENVIRONMENT_GROUP_NAME é o nome de um grupo de ambiente com aliases de host correspondentes, $CA_FILE é um certificado autorizado e $CERT_FILE e $KEY_FILE são arquivos de chave e certificado TLS. Consulte Criar certificados TLS.
Opção 2: secrets do Kubernetes
Criar dois secrets do Kubernetes O primeiro é para o par de certificado/chave SSL e o segundo é para a CA. Em seguida, adicione-os ao arquivo de substituição.
Crie dois secrets do Kubernetes em um dos dois namespaces a seguir:
namespace apigee, se você estiver usando o gateway de entrada da Apigee.
namespace istio-system se você estiver usando o Anthos Service Mesh instalado pelo cliente.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-28 UTC."],[[["\u003cp\u003eThis documentation explains how to enable one-way TLS or mTLS on the Apigee ingress gateway to secure API proxy endpoints.\u003c/p\u003e\n"],["\u003cp\u003eOne-way TLS can be configured by providing SSL certificate/key pairs in the \u003ccode\u003evirtualhosts\u003c/code\u003e property of the overrides file, or by using a Kubernetes Secret.\u003c/p\u003e\n"],["\u003cp\u003emTLS configuration requires either a Certificate Authority (CA) certificate along with SSL certificate/key files in the \u003ccode\u003evirtualhosts\u003c/code\u003e property, or the use of two Kubernetes Secrets, one for the SSL cert/key pair and one for the CA.\u003c/p\u003e\n"],["\u003cp\u003eKubernetes Secrets for both one-way TLS and mTLS can be created in either the \u003ccode\u003eapigee\u003c/code\u003e namespace for the Apigee ingress gateway, or in the \u003ccode\u003eistio-system\u003c/code\u003e namespace for customer-installed Anthos Service Mesh.\u003c/p\u003e\n"],["\u003cp\u003eThe current version of the Apigee hybrid documentation (v1.8) is end of life and users should upgrade to a newer version.\u003c/p\u003e\n"]]],[],null,["# Configuring TLS and mTLS on the ingress gateway\n\n| You are currently viewing version 1.8 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic explains how to enable one-way TLS and mTLS on the ingressgateway .\n\nConfiguring one-way TLS\n-----------------------\n\nUse one-way TLS to secure API proxy endpoints on the ingress gateway. To enable\none-way TLS, you configure the ingress with TLS cert/key pairs or with a Kubernetes\nSecret, as explained in the following options.\n\n### Option 1: key/cert pair\n\n\nProvide SSL cert and key files in the `virtualhosts` property in your overrides file: \n\n```scdoc\nvirtualhosts:\n - name: $ENVIRONMENT_GROUP_NAME\n sslCertPath: \"$CERT_FILE\"\n sslKeyPath: \"$KEY_FILE\"\n```\n\n\nWhere \u003cvar translate=\"no\"\u003e$ENVIRONMENT_GROUP_NAME\u003c/var\u003e is the name of an environment group with\ncorresponding host aliases, and \u003cvar translate=\"no\"\u003e$CERT_FILE\u003c/var\u003e and \u003cvar translate=\"no\"\u003e$KEY_FILE\u003c/var\u003e are TLS key and certificate\nfiles. See [Create TLS certificates](/apigee/docs/hybrid/v1.8/install-create-tls-certificates).\n\n### Option 2: Kubernetes Secret\n\n\nCreate a [Kubernetes\nSecret](https://kubernetes.io/docs/concepts/configuration/secret/) and add it to your overrides file.\n\n1. Create the Secret in one of the two following namespaces:\n - **apigee** namespace if you are using Apigee ingress gateway.\n - **istio-system** namespace if you are using customer-installed Anthos Service Mesh.\n\n ### Apigee ingress gateway\n\n ```\n kubectl create -n apigee secret generic $SECRET_NAME \\\n --from-file=key=$KEY_FILE \\\n --from-file=cert=$CERT_FILE\n ```\n\n ### Anthos Service Mesh\n\n ```\n kubectl create -n istio-system secret generic $SECRET_NAME \\\n --from-file=key=$KEY_FILE \\\n --from-file=cert=$CERT_FILE\n ```\n2. Configure the `virtualhosts` property in your overrides file: \n\n ```scdoc\n virtualhosts:\n - name: $ENVIRONMENT_GROUP_NAME\n tlsMode: SIMPLE # Note: SIMPLE is the default, so it is optional.\n sslSecret: $SECRET_NAME\n ```\n\nConfiguring mTLS\n----------------\n\n\nInstead of one-way TLS, you can configure\n[mTLS](https://en.wikipedia.org/wiki/Mutual_authentication) on the\ningress gateway. There are two options for configuring mTLS, as explained below.\n\n### Option 1: key/cert pair and CA file\n\n\nProvide a Certificate Authority (CA) certificate with SSL cert and key files in the\n`virtualhosts` property in your overrides file: \n\n```scdoc\nvirtualhosts:\n - name: $ENVIRONMENT_GROUP_NAME\n tlsMode: MUTUAL\n caCertPath: \"$CA_FILE\"\n sslCertPath: \"$CERT_FILE\"\n sslKeyPath: \"$KEY_FILE\"\n```\n\n\nWhere \u003cvar translate=\"no\"\u003e$ENVIRONMENT_GROUP_NAME\u003c/var\u003e is the name of an environment group with\ncorresponding host aliases, \u003cvar translate=\"no\"\u003e$CA_FILE\u003c/var\u003e is an authorized certificate, and \u003cvar translate=\"no\"\u003e$CERT_FILE\u003c/var\u003e and\n\u003cvar translate=\"no\"\u003e$KEY_FILE\u003c/var\u003e are TLS key and certificate\nfiles. See [Create TLS certificates](/apigee/docs/hybrid/v1.8/install-create-tls-certificates).\n\n### Option 2: Kubernetes Secrets\n\nCreate two Kubernetes Secrets. The first secret is for the SSL cert/key pair and the second is\nfor the CA. Then, add them to your overrides file.\n\n1. Create two Kubernetes secrets in one ofthe two following namespaces:\n - **apigee** namespace if you are using Apigee ingress gateway.\n - **istio-system** namespace if you are using customer-installed Anthos Service Mesh.\n\n ### Apigee ingress gateway\n\n ```\n kubectl create -n apigee secret generic $SECRET_NAME \\\n --from-file=key=$KEY_FILE \\\n --from-file=cert=$CERT_FILE\n ```\n\n ### Anthos Service Mesh\n\n ```\n kubectl create -n istio-system secret generic $SECRET_NAME \\\n --from-file=key=$KEY_FILE \\\n --from-file=cert=$CERT_FILE\n ```\n2. Create a secret for the CA:\n\n ### Apigee ingress gateway\n\n ```\n kubectl create -n apigee secret generic $SECRET_NAME-cacert \\\n --from-file=cacert=$CA_FILE\n ```\n\n ### Anthos Service Mesh\n\n ```\n kubectl create -n istio-system secret generic $SECRET_NAME-cacert \\\n --from-file=cacert=$CA_FILE\n ```\n3. Configure the `virtualhosts` property in your overrides file: \n\n ```scdoc\n virtualhosts:\n - name: $ENVIRONMENT_GROUP_NAME\n tlsMode: MUTUAL # Note: Be sure to specify MUTUAL\n sslSecret: $SECRET_NAME\n ```"]]
