Topik ini menjelaskan cara mengaktifkan TLS satu arah dan mTLS di ingressgateway.
Mengonfigurasi TLS satu arah
Gunakan TLS satu arah untuk mengamankan endpoint proxy API di gateway masuk. Untuk mengaktifkan TLS satu arah, Anda mengonfigurasi traffic masuk dengan pasangan kunci/sertifikat TLS atau dengan Secret Kubernetes, seperti yang dijelaskan dalam opsi berikut.
Opsi 1: pasangan kunci/sertifikat
Berikan file kunci dan sertifikat SSL di properti virtualhosts dalam file penggantian Anda:
Dengan $ENVIRONMENT_GROUP_NAME adalah nama grup lingkungan dengan
alias host yang sesuai, dan $CERT_FILE dan $KEY_FILE adalah file kunci dan sertifikat TLS. Lihat Membuat sertifikat TLS.
Konfigurasikan properti virtualhosts di file penggantian Anda:
virtualhosts:
- name: $ENVIRONMENT_GROUP_NAME
tlsMode: SIMPLE # Note: SIMPLE is the default, so it is optional.
sslSecret: $SECRET_NAME
Mengonfigurasi mTLS
Sebagai ganti TLS satu arah, Anda dapat mengonfigurasi
mTLS di gateway
masuk. Ada dua opsi untuk mengonfigurasi mTLS, seperti yang dijelaskan di bawah.
Opsi 1: pasangan kunci/sertifikat dan file CA
Berikan data sertifikat TLS yang berisi sertifikat Certificate Authority:
Dengan $ENVIRONMENT_GROUP_NAME adalah nama grup lingkungan dengan
alias host yang sesuai, $CA_FILE menentukan data sertifikat TLS (file paket CA)
yang berisi sertifikat Certificate Authority, dan $CERT_FILE dan
$KEY_FILE adalah file kunci dan sertifikat TLS. Lihat Membuat sertifikat TLS.
Opsi 2: Secret Kubernetes
Buat dua Secret Kubernetes. Secret pertama adalah untuk pasangan kunci/sertifikat SSL dan yang kedua adalah
untuk CA. Kemudian, tambahkan ke file penggantian Anda.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-03 UTC."],[[["\u003cp\u003eThis document provides instructions on enabling one-way TLS and mTLS on the Apigee hybrid ingress gateway for securing API proxy endpoints.\u003c/p\u003e\n"],["\u003cp\u003eOne-way TLS can be configured using either a key/cert pair provided directly in the \u003ccode\u003evirtualhosts\u003c/code\u003e property of the overrides file, or by creating a Kubernetes Secret containing the certificate information and referencing it in the overrides file.\u003c/p\u003e\n"],["\u003cp\u003emTLS configuration is achieved by providing a key/cert pair and a CA file directly within the \u003ccode\u003evirtualhosts\u003c/code\u003e property or by creating two Kubernetes Secrets, one for the SSL key/cert pair and another for the CA, which are then referenced in the overrides file.\u003c/p\u003e\n"],["\u003cp\u003eFor mTLS, the \u003ccode\u003etlsMode\u003c/code\u003e must be explicitly set to \u003ccode\u003eMUTUAL\u003c/code\u003e in the \u003ccode\u003evirtualhosts\u003c/code\u003e property when using Kubernetes Secrets.\u003c/p\u003e\n"]]],[],null,["# Configuring TLS and mTLS on the ingress gateway\n\n| You are currently viewing version 1.9 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThis topic explains how to enable one-way TLS and mTLS on the ingressgateway.\n\nConfiguring one-way TLS\n-----------------------\n\nUse one-way TLS to secure API proxy endpoints on the ingress gateway. To enable\none-way TLS, you configure the ingress with TLS cert/key pairs or with a Kubernetes\nSecret, as explained in the following options.\n\n### Option 1: key/cert pair\n\n\nProvide SSL cert and key files in the `virtualhosts` property in your overrides file: \n\n```scdoc\nvirtualhosts:\n - name: $ENVIRONMENT_GROUP_NAME\n sslCertPath: \"$CERT_FILE\"\n sslKeyPath: \"$KEY_FILE\"\n```\n\n\nWhere \u003cvar translate=\"no\"\u003e$ENVIRONMENT_GROUP_NAME\u003c/var\u003e is the name of an environment group with\ncorresponding host aliases, and \u003cvar translate=\"no\"\u003e$CERT_FILE\u003c/var\u003e and \u003cvar translate=\"no\"\u003e$KEY_FILE\u003c/var\u003e are TLS key and certificate\nfiles. See [Create TLS certificates](/apigee/docs/hybrid/v1.9/install-create-tls-certificates).\n| **Tip:** For security purposes, it is best practice to have a separate TLS cert/key pair for each virtual host. If you are using a Subject Alternative Name (SAN ) certificate, this TLS cert/key pair should be used on one virtual host that is shared across the domain.\n\n### Option 2: Kubernetes Secret\n\n\nCreate a [Kubernetes\nSecret](https://kubernetes.io/docs/concepts/configuration/secret/) and add it to your overrides file.\n\n1. Create the Secret in the **apigee** namespace: \n\n ```\n kubectl create -n apigee secret generic $SECRET_NAME \\\n --from-file=key=$KEY_FILE \\\n --from-file=cert=$CERT_FILE\n ```\n2. Configure the `virtualhosts` property in your overrides file: \n\n ```scdoc\n virtualhosts:\n - name: $ENVIRONMENT_GROUP_NAME\n tlsMode: SIMPLE # Note: SIMPLE is the default, so it is optional.\n sslSecret: $SECRET_NAME\n ```\n\nConfiguring mTLS\n----------------\n\n\nInstead of one-way TLS, you can configure\n[mTLS](https://en.wikipedia.org/wiki/Mutual_authentication) on the\ningress gateway. There are two options for configuring mTLS, as explained below.\n\n### Option 1: key/cert pair and CA file\n\n\nProvide TLS\ncertificate data containing Certificate Authority certificates: \n\n```scdoc\nvirtualhosts:\n - name: $ENVIRONMENT_GROUP_NAME\n tlsMode: MUTUAL\n caCertPath: \"$CA_FILE\"\n sslCertPath: \"$CERT_FILE\"\n sslKeyPath: \"$KEY_FILE\"\n```\n\n\nWhere \u003cvar translate=\"no\"\u003e$ENVIRONMENT_GROUP_NAME\u003c/var\u003e is the name of an environment group with\ncorresponding host aliases, \u003cvar translate=\"no\"\u003e$CA_FILE\u003c/var\u003e specifies TLS certificate data (CA bundle file)\ncontaining Certificate Authority certificates, and \u003cvar translate=\"no\"\u003e$CERT_FILE\u003c/var\u003e and\n\u003cvar translate=\"no\"\u003e$KEY_FILE\u003c/var\u003e are TLS key and certificate\nfiles. See [Create TLS certificates](/apigee/docs/hybrid/v1.9/install-create-tls-certificates).\n\n### Option 2: Kubernetes Secrets\n\nCreate two Kubernetes Secrets. The first secret is for the SSL cert/key pair and the second is\nfor the CA. Then, add them to your overrides file.\n\n1. Create two Kubernetes secrets the **apigee** namespace: \n\n ```\n kubectl create -n apigee secret generic $SECRET_NAME \\\n --from-file=key=$KEY_FILE \\\n --from-file=cert=$CERT_FILE\n ```\n2. Create a secret for the CA: \n\n ```\n kubectl create -n apigee secret generic $SECRET_NAME-cacert \\\n --from-file=cacert=$CA_FILE\n ```\n3. Configure the `virtualhosts` property in your overrides file: \n\n ```scdoc\n virtualhosts:\n - name: $ENVIRONMENT_GROUP_NAME\n tlsMode: MUTUAL # Note: Be sure to specify MUTUAL\n sslSecret: $SECRET_NAME\n ```"]]
