How do you configure TLS and certificates in Mule 4?

• A. Use a keystore and truststore, configure TLS context in HTTP connectors, and reference credentials via property placeholders.
• B. TLS is optional and auto-configured with no setup.
• C. Only truststore is needed; keystore is not used.
• D. TLS uses a separate external service; no keystore required.

Answer: (A)

TLS in Mule 4 is set up by providing both a keystore and a truststore and then wiring them into a TLS context on the HTTP components. The keystore holds the server’s private key and certificate, which is what the server presents during the TLS handshake. The truststore contains certificates of trusted authorities, which the client (or another service) uses to validate the server’s certificate or, in mutual TLS, to validate the client’s certificate. You configure these stores in the TLS context tied to the HTTP listener (for inbound TLS) or the HTTP request/connector (for outbound TLS). To keep credentials secure, you reference file paths and passwords with property placeholders or a secure vault rather than hardcoding them. This setup is necessary because TLS isn’t auto-enabled and cannot rely on a truststore alone—you also need the server’s certificate/private key to establish the connection. The TLS configuration is handled inside Mule, not by an external service.