title: securing spring boot app with mTLS - running on Swisscom App Cloud
body: <p>I have a spring boot app deployed to Swisscom App Cloud that should to be secured with mTLS.</p>
  
  <p>Obviously there's spring security... Specific to Swisscom App Cloud I read about securing traffic on <a href="https://docs.developer.swisscom.com/adminguide/securing-traffic.html" rel="nofollow noreferrer">https://docs.developer.swisscom.com/adminguide/securing-traffic.html</a>.</p>
  
  <p>It is unclear to me how the two play together...</p>
  
  <ul>
  <li>If I enable mTLS via spring security, would that work as is or would I need additional configuration for the Swisscom App Cloud? (I came across HTTP routing which mentions passing client certificates for mTLS <a href="https://docs.developer.swisscom.com/concepts/http-routing.html" rel="nofollow noreferrer">https://docs.developer.swisscom.com/concepts/http-routing.html</a>)</li>
  <li>Is the configuration of mTLS on Swisscom App Cloud a replacement for what I would otherwise enable with spring security or would I still need to configure something within my application?</li>
  <li>Securing traffic mentions deployment manifest and BOSH manifest, is the latter (and maybe additional) configuration needed to enable mTLS on Swisscom App Cloud (i.e. would I need to have access to configs besides the deployment manifest) ?</li>
  </ul>
  
  <hr>
  
  <p><strong>Update</strong></p>
  
  <p>My use case that I have a REST API that will be consumed by a client outside of Swisscom App Cloud. It was decided that it shall be secured using mTLS.</p>