Configure outbound SSL settings for a deployed API

An API uses its own Outbound SSL settings only when you explicitly override them here; otherwise, it falls back to the Gateway-level configuration, the same pattern used for Client Certificate Authentication.

Until you add an override, no API-level Outbound SSL record exists for that API, and the Gateway evaluates every outbound call from that API against its own Outbound MTLS, Trust All, and Hostname Verifier values. Once you save an API-level override, Boomi evaluates that API's outbound calls against the API-level record instead of the Gateway-level one, but only for those three toggles; the certificate fields remain Gateway-scoped.

Prerequisites

• Access to the API's Settings in API Management.
• Outbound SSL Settings enabled at the Gateway level (refer to Configure outbound SSL settings in a Gateway for more information). The API-level section is not configurable until you enable it there.

To configure outbound SSL settings for a deployed API:

1. In API Management, select Configure APIs and Applications > Manage API, select the API, and open its Settings > Outbound SSL page. Select Add API Outbound SSL to override the Gateway's settings for this API. Boomi enables Outbound SSL Settings automatically and loads Outbound MTLS, Trust All, and Hostname Verifier at their defaults.

2. Set Outbound MTLS for this API:

   • Enable it if this API's backend requires client certificate authentication. Enabling it uses the Gateway's Keystore Certificate, since you cannot set a different one for an individual API.
   • Leave it disabled (the default) if the backend only needs to prove its own identity.

3. Set Trust All for this API:

   • Disable it to have this API validate the backend's certificate against the Gateway's Gateway Trusted Certificates.
   • Leave it enabled (the default) to accept any certificate presented by the backend without validation.

4. Set Hostname Verifier for this API. As at the Gateway level, this setting only takes effect when Trust All is disabled:

   • Enable it to also confirm the backend certificate's hostname matches the server it is connecting to.
   • Leave it disabled (the default) to skip that additional hostname check.

5. Select Save. After you save, a Reset to Gateway Outbound SSL button appears; select it to discard your overrides and revert this API to the Gateway's settings. If an administrator disables Outbound SSL Settings at the Gateway level, Outbound SSL is also disabled for this API, including any override you saved here; re-enabling it at the Gateway level resets both the Gateway and API values to their defaults rather than restoring your previous configuration.

The API-level section reuses the Gateway's Keystore Certificate and Gateway Trusted Certificates. You cannot set different ones for an individual API. If you disable Trust All at the API level and the Gateway does not have a trusted certificate configured, Boomi shows a warning and blocks the save until you add one on the Gateway's Outbound SSL page.

Configuration reference

Field	Description	Default
Outbound SSL Settings	Master toggle for the outbound SSL section, at both the Gateway and API level. At the API level, Boomi enables this automatically when you select Add API Outbound SSL; you don't toggle it directly.	Enabled
Outbound MTLS	Requires the Gateway to present a client certificate to the backend during outbound calls for this API.	Disabled
Trust All	When enabled, it skips validation of the backend's certificate for this API.	Enabled
Hostname Verifier	Confirms the backend certificate's hostname matches the server the Gateway connects to. Has no effect when Trust All is enabled.	Disabled

Keystore Certificate and Gateway Trusted Certificates aren't configurable at the API level; the API always uses the values configured on the Gateway's Outbound SSL page.