Creating a TLS client profile

Create a TLS client profile to secure client connections to a TLS secured MCP or LLM provider API endpoint in DataPower Interact Gateway.

1. In DataPower Interact Gateway, click Settings.
2. Select Crypto Material.
3. In the TLS client profile section, click Create.
   The Create TLS client profile page appears.
4. Provide the following details:

   Table 1. TLS client profile configurations

   Field	Description
   Title	Enter a title for the profile.
   Name	The name is auto-generated from the title, with spaces and other URL-unsafe characters replaced.
   Version	Specify a version number for the profile. Using version numbers allows you to create multiple server profiles with the same name and different configurations, for example, MyProfile 1.0.0 and MyProfile 1.1.0.
   Summary	Enter a description of the profile.
   Protocols	Select one or more supported TLS protocol versions. The default is TLS version 1.2 and TLS version 1.3.
   Server Connection	Specify whether to support weak or insecure credentials. Allow insecure server connections - Insecure server connections can mean connections that use certificates that are self-signed, expired, corrupted, or from an unknown or untrusted source. Select this option to allow the connection to proceed with an insecure connection. By default, this option is disabled. Support Server Name Indication (SNI) - Select this option to enable SNI. SNI allows support for multiple certificates that are presented on the same IP address using different hostnames. The client profile sends the name of a virtual domain as part of the TLS negotiation. The default is to enable SNI.
   Keystore	A keystore is a repository that contains public and private key pairs. The keystore has the public key that the client presents when it initiates communication with a TLS secured endpoint. Note: If you create your own TLS profiles, DataPower Interact Gateway verifies certificates when you upload them but does not continuously monitor them for expiry. You are responsible for monitoring and updating your certificates before they expire.
   Truststore	A truststore is a repository that contains verified public keys. Truststores contain the list of certificates that your TLS client profile trusts. Note: If you create your own TLS profiles, DataPower Interact Gateway verifies certificates when you upload them but does not continuously monitor them for expiry. You are responsible for monitoring and updating your certificates before they expire.
   Ciphers	Cipher suites are encryption algorithms that are used to secure the TLS communication. Select the ciphers that the profile supports. Note: The TLS 1.3 ciphers are clearly indicated. If you select TLS version 1.3 as one of the protocols for the profile but do not select any TLS 1.3 ciphers, all the TLS 1.3 ciphers are added to the list of ciphers supported by the profile. If you do not select TLS version 1.3 but select one or more TLS 1.3 ciphers, those ciphers are not added to the list of ciphers supported by the profile.

5. Click Save.
   The TLS client profile is created to secure client connections in IBM DataPower Interact Gateway.