How do you support 2-way TLS in a Mule app listener?

How do you support 2-way TLS in a Mule app listener?

• A. Use an external security gateway
• B. Only configure keystore
• C. Add TLS context with mandatory keystore and mandatory truststore.
• D. TLS context with optional truststore

Answer: (C)

Two-way TLS means mutual authentication: the server proves its identity with its certificate, and the client proves its identity with its certificate. For a Mule app listener to support this, you must configure a TLS context that includes both the server’s keystore (holding the server certificate and private key) and a truststore (holding the CA certificates that verify client certificates). Making both keystore and truststore mandatory ensures that the client presents a valid certificate and that the server validates it, achieving mutual trust. That’s why the best approach is to add a TLS context with mandatory keystore and mandatory truststore. The keystore alone doesn’t verify clients, and making the truststore optional would allow connections without client certificates. Using an external gateway could terminate TLS outside of Mule, which wouldn’t guarantee mutual TLS end-to-end to the listener.

Two-way TLS means mutual authentication: the server proves its identity with its certificate, and the client proves its identity with its certificate. For a Mule app listener to support this, you must configure a TLS context that includes both the server’s keystore (holding the server certificate and private key) and a truststore (holding the CA certificates that verify client certificates). Making both keystore and truststore mandatory ensures that the client presents a valid certificate and that the server validates it, achieving mutual trust.

That’s why the best approach is to add a TLS context with mandatory keystore and mandatory truststore. The keystore alone doesn’t verify clients, and making the truststore optional would allow connections without client certificates. Using an external gateway could terminate TLS outside of Mule, which wouldn’t guarantee mutual TLS end-to-end to the listener.