Skip to content

Provision certificates to a MuleSoft Dedicated Load Balancer

Preview feature

This feature is available in Preview and isn't yet generally available (GA). Functionality and behavior can change before GA.

Provision a certificate from Certificate Manager - SaaS to a MuleSoft CloudHub Dedicated Load Balancer (DLB).

A DLB can have several SSL endpoints, each identified by the common name of its certificate. Certificate Manager - SaaS renews an SSL endpoint by replacing its certificate and private key.

Before you begin

  • A MuleSoft Dedicated Load Balancer machine that you created and whose status is Verified. The machine's Connected App must have the scope that grants the CloudHub Network Administrator permission for the organization or business group that owns the VPC.
  • The System Administrator or PKI Administrator role, or the Resource Owner role and membership in the machine's owning team.
  • The load balancer is started.
  • The load balancer has an SSL endpoint with the same common name (CN) as the certificate. Certificate Manager - SaaS renews existing SSL endpoints only. To add an endpoint, create it in Runtime Manager first.
  • Certificate Manager - SaaS has the certificate's private key and its issuer chain, for example because Certificate Manager - SaaS issued the certificate. You can't provision a certificate that Certificate Manager - SaaS only discovered.

To provision a certificate to a MuleSoft Dedicated Load Balancer

  1. Sign in to Certificate Manager - SaaS.
  2. Click Installations > Machines.
  3. Click the more options button at the end of the machine's row, and then select Provision.

  4. In Search a certificate by name, expiration or fingerprint, enter part of the certificate's name, expiration date, or fingerprint, and then select the certificate from the results. Confirm that it's the right certificate by checking Subject DN, Validity, and Certificate SHA1 Fingerprint.

    The rest of the Provision a certificate dialog appears after you select a certificate.

  5. Under Certificate Information, in VPC ID, enter the ID of the Anypoint VPC that hosts the load balancer.

  6. In Load Balancer ID, enter the ID of the load balancer.

  7. In Common Name, enter the common name of the SSL endpoint to renew.

    Tip

    The easiest way to fill in VPC ID, Load Balancer ID, and Common Name is to run discovery first, and then provision to a discovered installation from the machine's Installations tab. Discovery fills in all three values. Provisioning renews only an SSL endpoint that already exists on the load balancer, so the values must match an existing endpoint exactly.

  8. (Optional) Under Installation Endpoint, enter the Load Balancer Name and the Load Balancer Domain, such as <name>.lb.anypointdns.net (US), <name>.lb-prod-eu-rt.anypointdns.net (EU), or <name>.lb-gprod-rt.anypointdns.net (Gov). Discovery fills these in on the installations it finds.

  9. (Optional) To save the installation without pushing the certificate now, disable Push certificate on save.
  10. Click Save. To save and then provision another certificate, click Save & New.

After you save, Certificate Manager - SaaS replaces the certificate and private key of the SSL endpoint with the common name you entered, and an installation appears on the machine's Installations tab. To provision on a schedule instead of right away, set up a machine provisioning schedule.

Note

Certificate Manager - SaaS keeps the rest of the load balancer's configuration, including its other SSL endpoints, mapping rules, and default SSL endpoint.

Certificate Manager - SaaS can't restore the previous certificate after an update, because CloudHub never returns private keys.

If provisioning times out, check the load balancer in Runtime Manager, and then push the certificate again. If the load balancer already has the certificate, the push completes without changing it.