---
category: [Administration & Integrations, Administration & Integrations/Custom Integrations & Apps, Platform and Product Extensions, Platform and Product Extensions/Integration]
keyword: [Extend, Orchestration Builder, Orchestrate, Orchestration]
nav: wcp_docs
parent_url: /wcp_docs/
title: Configure Mutual HTTP Authentication
layout: subsection
---

### Prerequisites

<a id="confmtlsprereq"></a>
Security: <i>Security Administration</i> domain in the System functional area.

### Context

Orchestrate supports Mutual TLS for outbound connections using third-party keystores and truststores. Mutual TLS enables Workday and an external service to authenticate each other's identity, ensuring a high level of security and compliance.

To use a third-party keystore or truststore, you must create an Integration Credstore on your Workday tenant. The Integration Credstore securely stores and manages uploaded credentials. When you configure Mutual TLS in an orchestration's settings, you refer to the Credstore by its unique identifier, ensuring that the orchestation doesn't handle sensitive files directly.

Once you've created a Mutual TLS configuration, you can invoke it from the properties panel of the <b>Send HTTP Request</b> component.

This topic contains a table that briefly summarizes the token types a CredStore can work with. For more detailed information, see [Reference: Keystores and Truststores](/wcp_docs/GUID-b2af5887-f5b8-4821-9873-bde199045687-enHYPHENus.html).

### Steps

1.  Access the <b>Create Integration CredStore</b> task in Workday. This task enables you to create a secure credential management service that you can reference in Orchestration Builder rather than have your orchestration handle credentials itself. This table briefly summarizes the token types a CredStore can work with.

<table><thead><tr><th>Token Type</th><th>Description</th></tr></thead><tbody><tr><td>JKS_KEYSTORE</td><td>Keystore only in JKS format. For Mutal TLS, use in association with the default Workday truststore.</td></tr><tr><td>JKS_TRUSTSTORE</td><td>Truststore only in JKS format. For Mutal TLS, use in association with a Workday-issued certificate.</td></tr><tr><td>JKS_KEYSTORE_TRUSTSTORE</td><td>Both keystore and truststore in JKS format for Mutual TLS.</td></tr><tr><td>BCFKS_KEYSTORE</td><td>Keystore only in BCFKS format. For Mutal TLS, use in association with the default Workday truststore. <p><b>Note:</b> Available in Federal Information Processing Standards-compliant environments only.</p></td></tr><tr><td>BCFKS_TRUSTSTORE</td><td>Truststore only in BCFKS format. For Mutal TLS, use in association with a Workday-issued certificate. <p><b>Note:</b> Available in Federal Information Processing Standards-compliant environments only.</p></td></tr><tr><td>BCFKS_KEYSTORE_TRUSTSTORE</td><td>Both keystore and truststore in BCFKS format for Mutual TLS. <p><b>Note:</b> Available in Federal Information Processing Standards-compliant environments only.</p></td></tr></tbody></table><br/>

2.  Complete the fields described in this table, then click <b>OK</b>.

<table><thead><tr><th>Field</th><th>Description</th></tr></thead><tbody><tr><td>App ID</td><td>The unique identifier for the developer site application that will use the Integration Credstore. Available on the developer site as Application Reference. Example: myextendapp2_weqef. An Integration Credstore can map to only 1 application.</td></tr><tr><td>External Reference ID</td><td>A unique identifier for these credentials that you can reference in Orchestration Builder.</td></tr><tr><td>Functional Feature Service Mapping</td><td>Select Workday Orchestrate.</td></tr><tr><td>Token Type</td><td>The credential type. Example: JKS_KEYSTORE.</td></tr><tr><td>Token Data</td><td>The Base64-encoded ZIP file containing the keystore/truststore files.</td></tr><tr><td>Keystore Password</td><td>The password for the keystore (encrypted at rest). Mandatory for Mutual TLS types.</td></tr><tr><td>Truststore Password</td><td>The password for the truststore (encrypted at rest).</td></tr><tr><td>Expiration Time</td><td>(Optional) The expiration date for this Credstore, entered in ISO 8601 format.</td></tr><tr><td>Descriptor</td><td>A description of this Credstore.</td></tr></tbody></table><br/>

3.  In Orchestration Builder, access the <b>Settings</b> page for the orchestration for which you want to establish Mutual TLS.
4.  On the <b>Settings</b> page, select <b>Mutual Auth</b>.
5.  Provide a <b>Name</b> for the configuration.
6.  Click <b>Connect to a Tenant</b> to import TLS credentials from your tenant. Alternatively, follow the steps below to enter the details manually.
7.  In the <b>External Reference ID</b> expression field, refer to the External Reference ID of the Credstore you created on your tenant .
8.  (Optionally) Enter the <b>Token Type</b> that the Credstore is configured to use.
9.  (Optionally) Enter a <b>Description</b> for the configuration.
10. Click <b>Create</b>.


### Result

<a id="mtlsresult"></a>
On the <b>Integration Credstore</b> tab of <b>Settings</b> page you can select the mutual TLS configuration you created as the default for your orchestration, applying it to all of its <b>Send HTTP Request</b> steps. Alternatively, you can select the TLS configuration from the <b>Authentication</b> drop-down list on the <b>Auth</b> tab of any individual <b>Send HTTP Request</b> step, applying it to that step only.

### Example

On your Workday tenant, you create an Integration Credstore with the External Reference ID `credstore_jks`, using the JKS Keystore Truststore token type. In Orchestration Builder, on your orchestration's <b>Settings</b> page, you create a Mutual Authentication configuration called `TLS JKS`. The configuration references the Credstore's <b>External Reference ID</b>, `credstore_jks`. On a <b>Send HTTP Request</b> step, you can now refer, in turn, to the configuration, ensuring mutual authentication between your orchestration and the external service it connects to.

### Related Information

[Reference: Keystores and Truststores](/wcp_docs/GUID-b2af5887-f5b8-4821-9873-bde199045687-enHYPHENus.html)