Configure outbound SSL settings in a Gateway
Configuring Outbound SSL at the Gateway level sets the default behavior for every API deployed to that Gateway. An API uses its own Outbound SSL settings when you configure them; otherwise, it falls back to the Gateway-level settings, including the Keystore Certificate and Gateway Trusted Certificates you configure here (refer to Configure outbound SSL settings for a deployed API for more information).
Prerequisites
- Access to the Outbound SSL settings for your Gateway in API Management.
To configure outbound SSL settings:
- In Gateway Settings, open the Outbound SSL page.
- Enable Outbound SSL Settings to configure outbound SSL for this Gateway:
- When enabled, it allows you to configure Outbound MTLS, Trust All, Hostname Verifier, and Keystore Certificate fields. You create certificates as an Integration Certificate component and manage them in that application; if you don't already have one, select Create New Certificate from the Keystore Certificate or Gateway Trusted Certificates lookup to create one directly.
- When disabled, other fields on the Outbound SSL page stay hidden and inactive. Disabling Outbound SSL Settings and re-enabling it resets Outbound MTLS, Trust All, Hostname Verifier, Keystore Certificate, and Gateway Trusted Certificates to their default values; it does not preserve your previous configuration.
- Disabling Outbound SSL Settings at the Gateway level also disables it for every API deployed to that Gateway, including any API-level override (refer to Configure outbound SSL settings for a deployed API).
- Set Outbound MTLS based on what the backend requires:
- Enable it if the backend enforces client certificate authentication, for example, banking, government, or other regulatory-mandated integrations that reject connections without a valid client certificate. If you enable Outbound MTLS, then adding a Keystore Certificate is mandatory, since that is the certificate the Gateway presents. This requirement applies specifically to Outbound MTLS: you do not need to select a Keystore Certificate for standard Outbound SSL settings unless Outbound MTLS is enabled. The Gateway keystore must already contain a Gateway certificate before you can enable Outbound MTLS; if it does not, Boomi prompts you to add one first.
- Leave it disabled (the default) if the backend only needs to prove its own identity and does not need the Gateway to authenticate itself. Whether to enable or disable this setting depends entirely on your backend's specific requirements.
- Set Trust All based on whether the Gateway should validate the backend's certificate:
- Disable it to have the Gateway validate the backend's certificate against Gateway Trusted Certificates instead; outbound calls fail unless you configure at least one there (see step 7 to add one).
- Leave it enabled (the default) so the Gateway accepts any certificate the backend presents without validation.
- Set Hostname Verifier based on whether you want extra validation on top of the certificate chain. This setting only takes effect when Trust All is disabled; if Trust All is enabled, the Gateway skips certificate validation entirely, and Hostname Verifier has no effect:
- Enable it so the Gateway also confirms that the backend certificate's hostname matches the server it is connecting to.
- Leave it disabled (the default) to skip that additional hostname check.
- Select a Keystore Certificate, the certificate that the Gateway presents to the backend. This field is required only when Outbound MTLS from step 3 is enabled, since that is the certificate the Gateway presents to the backend; if Outbound MTLS is disabled, the field is optional:
- If a certificate is already attached to the Gateway, Boomi auto-populates this field.
- Otherwise, choose one from the drop-down.
- Select Gateway Trusted Certificates based on your Trust All setting from step 4:
- If Trust All is enabled (the default): skip this step, since the Gateway then skips validating the backend's certificate entirely.
- If Trust All is disabled, add at least one certificate here. Select + Add Certificate to open a certificate lookup, then search for an existing Integration Certificate component or select Create New Certificate to create one first. The table lists each certificate's Name, Version, Issued On, Expires On, and Actions (edit or delete); if the underlying certificate component changes in Integration, an indicator appears on its Version so you know to upgrade it here.
- Select Save. Boomi displays a confirmation message once you save the settings.
