Skip to content

Create a MuleSoft Dedicated Load Balancer machine

Preview feature

This feature is available in Preview and isn't yet generally available (GA). Functionality and behavior can change before GA.

Create a machine to connect Certificate Manager - SaaS to MuleSoft Anypoint Platform. Certificate Manager - SaaS then discovers and renews the certificates on the SSL endpoints of your CloudHub 1.0 Dedicated Load Balancers (DLBs). CloudHub 2.0 and Anypoint Platform Private Cloud Edition aren't supported. If you migrate a load balancer to CloudHub 2.0, its certificates drop out of the Certificate Manager - SaaS inventory.

Before you begin

  • The System Administrator, PKI Administrator, or Resource Owner role. If you have the Resource Owner role, you must own or belong to at least one team.

  • A Connected App in Anypoint Platform with scopes that grant the CloudHub network permissions. To create one:

    1. Sign in to Anypoint Platform as an Organization Administrator of the business group that owns the VPCs.
    2. Go to Access Management > Connected Apps > Owned Apps, and then click Create App.
    3. Enter a name, and then select App acts on its own behalf (client credentials).

    4. Click Add Scopes, and then add the scopes that grant the CloudHub Network Viewer permission, for discovery, and the CloudHub Network Administrator permission, for provisioning.

    5. Select the business group whose ID you'll enter as Organization ID, select its environments, and then save.

    6. Copy the client ID and client secret.

  • The ID of the Anypoint organization or business group that owns the VPCs.

  • For discovery, allow Certificate Manager - SaaS to reach each load balancer on port 443. If a load balancer has an IP allowlist, add the Certificate Manager - SaaS egress IP addresses to it.

For more information, see Creating Connected Apps in the MuleSoft documentation.

Note

Certificate Manager - SaaS connects to Anypoint Platform directly, without a VSatellite.

Important

Create one machine for each organization or business group that owns VPCs, usually only the root organization. A child business group also sees the VPCs it inherits from its parents, so machines for overlapping groups discover and renew the same load balancers twice.

To create a MuleSoft Dedicated Load Balancer machine

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click New, and then select MuleSoft Dedicated Load Balancer (Preview).
  4. On the Properties step, in Name, enter a name for the machine.
  5. For Owning Team, choose the team that owns the machine. System Administrators and PKI Administrators can choose any team. Resource Owners can choose only a team they own or belong to.

  6. For Anypoint Platform Host, choose the MuleSoft control plane that hosts your organization:

    • anypoint.mulesoft.com (US). This is the default.
    • eu1.anypoint.mulesoft.com (EU)
    • gov.anypoint.mulesoft.com (Gov)

  7. In Organization ID, enter the ID of the Anypoint organization or business group that owns the VPCs, in UUID format.

  8. For Credential Type, choose how to provide the credentials:

    • Enter Credentials to enter the credentials in the next step. This is the default.
    • Select Credentials to use shared credentials from a credential manager integration. Then, for Credential, choose the credential.

    Note

    Select Credentials requires the credential manager capability, which requires additional licensing. Without it, Credential shows No credentials are available. System Administrators and PKI Administrators can choose any credential. Resource Owners can choose only the credentials that belong to their teams.

  9. If you chose Enter Credentials, enter the Connected App's Client ID and Client Secret. If you chose Select Credentials, the stored credential must hold the Connected App's client ID as its username and the client secret as its password.

    Note

    Certificate Manager - SaaS encrypts the credentials you enter and doesn't display them again. On the machine's Properties tab, they appear masked. To keep a stored credential when you edit the machine, leave its masked value unchanged. Keep your own secure record of the credentials in case you need them again.

  10. (Optional) To discover only the load balancers in VPCs associated with one environment, enter its Environment ID in UUID format. To discover the load balancers in every VPC of the organization, leave this field empty.

    Test Access doesn't check this value. If no VPC in the organization is associated with the environment, discovery fails.

  11. Click Test Access. After the connection succeeds, click Continue. The Discovery step opens.

    Note

    The test checks the credentials and the CloudHub Network Viewer permission. Provisioning also needs the CloudHub Network Administrator permission, which the test can't check.

    If the test fails, check the Anypoint Platform Host, the Organization ID, and the client ID and client secret. Also check that the Connected App has scopes that grant the CloudHub network permissions, and that the business group with this Organization ID is selected for it.

  12. (Optional) To skip certificates that have already expired, enable Exclude Expired Certificates.

  13. (Optional) To discover only the load balancers in specific Anypoint VPCs, under VPC IDs, click + for each VPC and enter its ID. If you leave this list empty, discovery includes every VPC in the organization, or every VPC associated with the machine's Environment ID.

    Discovery fails if a listed VPC isn't in the organization or environment, or if Certificate Manager - SaaS can't list its load balancers.

  14. (Optional) To discover only specific load balancers, under Load Balancer Names, click + for each load balancer and enter its exact name. If you leave this list empty, discovery includes all load balancers.

    Discovery fails if a listed load balancer isn't found, is stopped, or isn't reachable from Certificate Manager - SaaS on port 443.

    Note

    Discovery reads the certificate that each started load balancer serves on port 443, and creates one installation for each SSL endpoint. A certificate on several load balancers gets an installation on each.

    Discovery skips stopped load balancers, and Certificate Manager - SaaS removes their installations after about 3 days. To restore them, start the load balancer in Runtime Manager, and then run discovery again.

  15. (Optional) To discover certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

  16. Click Continue. The Provisioning step opens.

  17. (Optional) To provision certificates on a schedule, enable Schedule. For Repeat every, choose Day, Week, or Month, and then in At, enter the time. For Week, select the days of the week. For Month, enter the days in Day of month. Times are in Coordinated Universal Time (UTC).

    Scheduled provisioning pushes only certificates that are queued for deployment, such as renewed certificates, so renewals install during the window you choose.

  18. Click Finish.

Troubleshoot discovery

If discovery fails and names a load balancer, check that it's reachable from Certificate Manager - SaaS on port 443, and then run discovery again.

If discovery fails and names an SSL endpoint (as <load balancer name>/<common name>), the load balancer was reachable but didn't serve that endpoint's certificate. Check for one of these causes, and then run discovery again:

  • The load balancer serves another endpoint's certificate for that name. This happens with a wildcard endpoint that has no concrete subject alternative name (SAN), or with a SAN that a more specific endpoint also serves. Add a SAN to the endpoint's certificate that no other endpoint serves.
  • The TLS handshake failed. Check the endpoint's certificate and private key in Runtime Manager.

In both cases, discovery adds every other certificate it can read, and keeps the existing installations of the load balancers and endpoints it names.

What's next?

After you create the machine, run discovery on it to find the certificates already on your load balancers. You can then provision certificates to it to renew the certificates on existing SSL endpoints.