[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-05。"],[[["\u003cp\u003eThis page outlines how Apigee and Apigee hybrid capture and provide access to TLS connection information through flow variables within an API proxy.\u003c/p\u003e\n"],["\u003cp\u003eApigee captures TLS details such as cipher, protocol, server name, and session ID for both one-way and two-way TLS connections.\u003c/p\u003e\n"],["\u003cp\u003eFor two-way TLS, Apigee hybrid additionally captures client certificate information, including the subject and issuer Distinguished Names, raw certificate data, serial number, and fingerprint.\u003c/p\u003e\n"],["\u003cp\u003eAPI proxies can access and utilize these TLS flow variables through policies like AssignMessage or JavaScript, or within flow conditions and routing rules.\u003c/p\u003e\n"],["\u003cp\u003eEnabling two-way TLS on Apigee hybrid requires configuring the ingress to request client certificates.\u003c/p\u003e\n"]]],[],null,["# Accessing TLS connection information in an API proxy\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\n\nThis topic explains how to access TLS connection information in flow variables for an API proxy\nrunning on Apigee or Apigee hybrid.\n\nCapturing TLS connection information\n------------------------------------\n\n\nDuring a request to an API proxy, Apigee can capture information about the TLS connection. Your\nAPI proxy can then access that information through flow variables to perform additional\nanalysis and validation.\n\n\nThe type of TLS information captured by Apigee depends on whether the Ingress is configured to\nsupport one-way or two-way TLS (only applicable with Apigee hybrid). For example, for one-way\nTLS, Apigee can capture information about the TLS cipher or TLS protocol used in the TLS connection.\n\n\nFor two-way TLS, Apigee can capture all of the same information as captured for one-way TLS,\nand also capture information about the client's cert. For example, Apigee can capture the\nSHA1 fingerprint of the client cert and the client cert in the PEM format.\n\n### Capturing information for both one-way and two-way TLS\n\n\nThe following table lists the flow variables that contain TLS connection information captured by\nApigee and Apigee hybrid, and available for access in the API proxy.\n\n### Capturing additional TLS information during two-way TLS\n\n| **Note:**Enabling mTLS only applies to Apigee hybrid.\n\n\nThe following table lists the flow variables that contain client cert details captured by\nApigee hybrid in two-way TLS:\n\nConfiguring Apigee hybrid to enable two-way TLS\n-----------------------------------------------\n\n\nTo configure the ingress to request a client certificate, add the following details to the\noverrides file: \n\n```text\nvirtualhosts:\n - name: internal\n minTLSProtocolVersion: \"1.2\" #optional\n maxTLSProtocolVersion: \"1.2\" #optional\n tlsMode: MUTUAL\n sslSecret: tls-certificates\n```\n\n\nSee also [Configuring TLS and mTLS on the Istio\ningress](/apigee/docs/hybrid/latest/ingress-tls).\n\nAccessing the flow variables in an API proxy\n--------------------------------------------\n\n\nFrom within your API proxy, you can access and inspect the TLS flow variables. For example, you can\nuse the [AssignMessage](/apigee/docs/api-platform/reference/policies/assign-message-policy) or\n[JavaScript](/apigee/docs/api-platform/reference/policies/javascript-policy) policy to access them.\n\n\nYou can also reference the flow variables in a `\u003cCondition\u003e` element of a proxy or\ntarget flow, or in a `\u003cStep\u003e` or `\u003cRouteRule\u003e`. For example, you could\nroute a request to different targets based on the SN of the client.\n\n\nFor more, see:\n\n- [Overview of flow variables](/apigee/docs/api-platform/fundamentals/introduction-flow-variables)\n- [Controlling how a proxy executes with flows](/apigee/docs/api-platform/fundamentals/what-are-flows)"]]
