How do you support TLS in a Mule app listener?

• A. Use a TLS policy in API Manager
• B. TLS is not supported
• C. Add TLS context to HTTPS listener with mandatory keystore and optional truststore.
• D. Add a server certificate to the repository

Answer: (C)

Enabling TLS for a Mule app listener is done by attaching a TLS context to the HTTPS listener. The TLS context tells Mule where the server’s certificate and private key are stored so the server can present them during the TLS handshake. The keystore is mandatory because the server must have its private key and certificate to establish TLS. The truststore is optional and used if you want to validate client certificates (mutual TLS) or trust specific CAs for upstream connections; if you don’t need client authentication, you can omit it.

In practice, you configure the TLS context with the keystore file (and its password) and, if needed, the truststore (and its password). This is the correct approach because TLS is configured at the listener level, not via an API Manager policy, and you don’t just place a certificate in a repository—the server’s keystore must be referenced by the TLS context.