PSP Benefits Verification

Production TLS and Keystore Configuration

Warning: This app includes a default Java KeyStore (JKS), <module-name>-keystore.jks, for initial deployment and local testing. The bundled JKS is an example keystore. Don't use it in production.
Before routing production traffic, replace the default JKS with a private key and certificate issued for your organization. Choose the instructions for your deployment model.

Path A: Configure TLS in a CloudHub 2.0 Private Space

Manage certificates at the platform level without changing the app package.
1. In Anypoint Platform, go to Runtime Manager > Private Spaces.
2. Select your private space, and then select the Domains & TLS tab.
3. In the TLS context configuration, upload your organization's PEM or JKS file.
4. Enter the passwords and aliases for your organization's certificate.
For more information, see Configure Private Space Domains.

Path B: Replace the Bundled JKS for Standalone, CloudHub 1.0, or Runtime Fabric Deployments

For deployment models that load a JKS from the app package, replace the bundled file before deployment.
1. Use your organization's public key infrastructure (PKI) or Java keytool to generate a JKS.
2. Open the app package, or import the app into Anypoint Studio. Go to src/main/resources/tls/.
3. Delete <module-name>-keystore.jks, and add the organization-specific JKS.
4. Update the app's configuration properties to match the new keystore. For example, update the values on the Runtime Manager Properties tab or in the YAML configuration file:
- keystore.alias: <new-alias>
- keystore.password: <new-keystore-password>
- keystore.keyPassword: <new-key-password>
5. Store passwords as secure configuration properties. Don't store unencrypted passwords in source-controlled configuration files.
6. Deploy the updated app package.
For more information, see TLS Configuration.