API / APIGEE Gateway Interview Questions
How does TLS and mutual TLS (mTLS) work in Apigee?
Apigee supports TLS on both the northbound (client-to-Apigee) and southbound (Apigee-to-backend) connections. Mutual TLS adds client certificate verification, enabling strong two-way authentication without API keys or tokens.
| Direction | Where configured | Purpose |
|---|---|---|
| Northbound (client to Apigee) | Virtual host / Environment Group SSL config | Client must present a valid certificate (mTLS) or just validate Apigee's cert (TLS) |
| Southbound (Apigee to backend) | TargetEndpoint or Target Server SSLInfo | Apigee validates backend cert; optionally sends its own client cert for mTLS |
<!-- Southbound TLS (Apigee to backend): TargetEndpoint --> <TargetEndpoint name="default"> <HTTPTargetConnection> <SSLInfo> <Enabled>true</Enabled> <!-- Verify the backend certificate --> <TrustStore>ref://truststore-backend</TrustStore> <!-- mTLS: Apigee presents its own client certificate --> <ClientAuthEnabled>true</ClientAuthEnabled> <KeyStore>ref://keystore-apigee-client</KeyStore> <KeyAlias>apigee-client-cert</KeyAlias> <!-- Optionally ignore backend cert validation (dev only!) --> <IgnoreValidationErrors>false</IgnoreValidationErrors> </SSLInfo> <URL>https://api.internal.example.com</URL> </HTTPTargetConnection> </TargetEndpoint> <!-- Keystores and Truststores are managed as environment-scoped resources in Apigee: Keystore: holds the private key + certificate Apigee presents Truststore: holds trusted CA certificates Apigee uses to validate backend certificates Created via Apigee API: POST /organizations/{org}/environments/{env}/keystores POST /organizations/{org}/environments/{env}/keystores/{ks}/aliases -->
What is the difference between TLS and mutual TLS (mTLS) in the context of Apigee?
In Apigee, what does the TrustStore in a TargetEndpoint SSLInfo block contain?
More Related questions...
