One-Way SSL vs Two-Way SSL: A Complete Guide with MuleSoft Implementation

In today’s digital age, securing data in transit is paramount. As a MuleSoft developer, you’re likely familiar with the importance of securing APIs and ensuring that sensitive information is protected. One of the most common methods to achieve this is through SSL (Secure Sockets Layer) and its successor, TLS (Transport Layer Security). In this blog, we’ll dive deep into One-Way SSL and One-Way SSL what it is, how it works, and how you can implement it in your MuleSoft applications.

What is One-Way SSL?

One-Way SSL, also known as Server-Side SSL, is a security protocol where only the server is authenticated to the client. The client verifies the server’s identity using the server’s SSL certificate, but the server does not verify the client’s identity. This is the most common form of SSL used in web applications and APIs.

Think of it like this: when you visit a secure website (HTTPS), your browser (the client) checks the website’s SSL certificate to ensure it’s valid and issued by a trusted Certificate Authority (CA). However, the website doesn’t check who you are—it only ensures that the communication between you and the server is encrypted.

How Does One-Way SSL Work?

Client Requests a Secure Connection – The client initiates an SSL/TLS handshake with the server.

Server Sends SSL Certificate – The server provides its SSL certificate, issued by a trusted Certificate Authority (CA).

Client Verifies the Certificate – The client checks if the certificate is valid, trusted, and matches the server’s domain.

Encryption Protocol Agreement – The client and server agree on an encryption method to secure communication.

Secure Communication Begins – All data exchanged is encrypted, ensuring confidentiality and integrity.

SSL Made Easy: Generate, Configure, and Secure Your Connections

Step 1 

Create a keystore for the server, which will contain the private key and certificate.

keytool -genkey -alias mule-server -keysize 2048 -keyalg RSA \

-keystore server-keystore.jks -storepass server123 -keypass server123 \

-dname "CN=server, OU=IT, O=MyCompany, L=City, ST=State, C=IN"

Step 2

Extract the server’s public certificate from the keystore.

keytool -export -alias mule-server -keystore server-keystore.jks \

-file server_public.crt -storepass server123

Step 3

The client needs to trust the server, so we import the server's certificate into the client's truststore.

keytool -import -alias mule-server-public -keystore client-truststore.jks \

-file server_public.crt -storepass client123 -noprompt

After running the necessary keytool commands in CMD, follow these steps to configure One-Way SSL in Anypoint Studio:

Step 1: Configure the Client (one-way-ssl-client.xml)

Drag an HTTP Listener to the flow.

Set the port to 8081 (used for receiving client requests).

Drag Logger to print the received payload (helps in debugging).

Drag an HTTPS Request and configure:

Method: POST

URL: https://localhost:8082/ssl-server

TLS Configuration: Set the truststore with the necessary server certificate details.

Step 2: Configure the Server (one-way-ssl-server.xml)

Drag an HTTPS Listener to the flow.

Set the port to 8082 (this will accept secure client requests).

Set the Path to /ssl-server (same as in the client's HTTP Request).

Configure TLS Keystore (since the server must present its certificate).

Drag a Logger to print the received payload (helps in debugging).

Now, run both applications and test the connection!

I have shared screenshots for reference to make it clearer! 

what If the truststore is lost. see the postman response

 

What is Two-Way SSL?

Two-Way SSL, also called Mutual SSL, is a security protocol where both the server and the client authenticate each other. Unlike One-Way SSL, where only the server is verified, Two-Way SSL ensures that both parties prove their identities before any communication begins.

How is Two-Way SSL Different from One-Way SSL?

One-Way SSL: Only the server has an SSL certificate, and the client verifies the server’s identity. The server doesn’t check who the client is.

Example: When you visit an HTTPS website, your browser checks the website’s certificate, but the website doesn’t check your identity.

Two-Way SSL: Both the server and the client have SSL certificates. They verify each other’s identity before starting communication.

Why Use Two-Way SSL?

Two-Way SSL is used in scenarios where extra security is needed. For example:

Banking APIs: Banks want to ensure that only authorized clients (like mobile apps) can access their services.

Highly Sensitive Data: When transmitting highly confidential data, both parties need to verify each other’s identity.

How Does Two-Way SSL Work?

Two-Way SSL (Mutual SSL) ensures that both the client and server authenticate each other before establishing a secure connection. Here’s how it works:

Client Requests a Secure Connection – The client initiates an SSL/TLS handshake with the server.

Server Sends SSL Certificate – The server provides its SSL certificate for authentication.

Client Verifies the Server – The client checks if the server’s certificate is valid and trusted.

Server Requests Client Certificate – Unlike One-Way SSL, the server now asks the client to present its own SSL certificate.

Server Verifies the Client – The server validates the client’s certificate to ensure it is from a trusted authority.

Secure Communication Begins – Once both parties are authenticated, encrypted data exchange starts.

After running the necessary keytool commands in CMD, follow these steps to configure One-Way SSL in Anypoint Studio:

Step 1: Configure the Client (two-way-ssl-client.xml)

Drag an HTTP Listener to the flow.

Set the port to 8081 (used for receiving client requests).

Drag Logger to print the received payload (helps in debugging).

Drag an HTTPS Request and configure:

Method: POST

URL: https://localhost:8082/ssl-server

TLS Configuration: Set the Keystore (contains client certificate). Set the Truststore (to trust the server's certificate).

Step 2: Configure the Server (two-way-ssl-server.xml)

Drag an HTTPS Listener to the flow.

Set the port to 8082 (this will accept secure client requests).

Set the Path to /ssl-server (same as in the client's HTTP Request).

Configure TLS : Set the Keystore (contains server certificate).Set the Truststore (to trust the client’s certificate).

Drag a Logger to print the received payload (helps in debugging).

Now, run both applications and test the connection!

I have shared screenshots for reference to make it clearer!