Two-Way SSL In Mule Application

Introduction

In my previous article, I have explained how Two-Way SSL works with the context of Mule Application. Many people have asked the question about how to setup HTTPS request in Mule application. This article provide the details about the procedures to invoke HTTPS services which require Two-Way SSL or Mutual Authentication. Before we dive into the detail procedures, lets review how Two-Way SLL works between clients and servers.

The gist of Two-Way SSL is to exchange certificates between clients and servers. The details are pretty complicated and they beyond the scope of this article. Basically, here are the high level scheme of the exchange of certificates:

1. Client send a ClientHello message to a server
2. Server replies with ServerHello, Server's certificate, and Request for Client's certificate
3. Client its certificate other information like cipher scheme, server's certificate verification, etc.
4. Server replies with cipher scheme.
5. Start to exchange information

Now, how do we setup Mule Application as client?

Client's Certificate Generation

In general, IT admin will generate client certificates similar as I describe in my blog here Let's assume that is the way for now so that we can describe how to setup Mule HTTPS Request. Before we continue, we need to obtain server's certificate in advance. The certificate can be in many forms like JKS, PKCS12, PEM, etc. Mule HTTPS request support three forms:

• JKS
• PKCS12
• JCEKS

Let's say if we got PEM format from the server. We need to do one of the two things depending on the deployment pattern.

• if it is on-prem deployment, the best way is to import the cert to JVM cacerts
• if it is deployed to MuleSoft CloudHub, we need to convert the PEM to PKCS12.

If it is on-prem deplopment, we can import the the PEM certificate directly into cacerts here is the procedure (Make sure you have sudo permission, and server's cert is named like SERVER_CERT.pem)

cd ${JAVA_HOME}/jre/lib/security
cp SERVER_CERT.pem
sudo keytool -import -alias mule1-cyberark -keystore cacerts -file SERVER_CERT.pem

To be sure that server's cert is in pem format, you can use the following command:

$ openssl x509 -in SERVER_CERT.pem -text

If it is CloudHub deployment, we need to convert the pem file to PKCS12 format. Here is the command:

$ openssl pkcs12 -export -nokeys -in SERVER_CERT.pem -out SERVER_CERT.pfx

Note the option of "-nokeys". This means I do not have the private key of the certificate. Now we have server's certificates being taken care of. We need to convert the client's certificate to PKCS12. Here is the command to do so:

 openssl pkcs12 -export -in cacert.pem -inkey cakey.pem -out identity.p12 -name "mykey"

Note the above procedure will ask the password. Make sure you remember it.

Setup Mule Flow

The following diagram shows the simple Mule flow

The https request configuration is the following:

The import point here is that client's certificate is

and server's certificates is