## 4.3.1.2.3.4  Exposing and Securing Workloads with a Certificate
Learn how to expose and secure a workload with mutual authentication using a TLS Gateway.
## Prerequisites
- You have the Istio and API Gateway modules added. See Adding and Deleting a Kyma Module [page 3157].
- You have access to Kyma dashboard. Alternatively, to use CLI instructions, you must install kubectl and configure it to communicate with your Kyma runtime instance. See Access a Kyma Instance Using kubectl [page 2018].
- You have installed curl .
- You have a deployed workload.
##  Note
To expose a workload using APIRule in version v2 , the workload must be a part of the Istio service mesh. See Enabling Istio Sidecar Proxy Injection [page 1783].
- You have set up your custom domain .
- You have set up an mTLS Gateway. See Setting Up an mTLS Gateway .
## Context
To expose and secure a workload with mutual authentication using TLS Gateway, you must create an APIRule custom resource (CR) that adds the X-CLIENT-SSL headers to incoming requests. Follow the procedure to learn how to do this.
## Procedure
- You can use either Kyma dashboard or kubectl.
- Use Kyma dashboard.
- a. Go to Discovery and Network &gt; APIRule and select Create .
- b. Add a name for your APIRule CR.
- c. Add the name and namespace of the Gateway you want to use.
- d. Specify the host.
- e. Add a Rule with the following configuration:
- f. Choose Create .
- Use kubectl.
| Parameter         | Option                                                                                                                                                                           |
|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Path              | /*                                                                                                                                                                               |
| Methods           | GET                                                                                                                                                                              |
| Access Strategy   | No Auth                                                                                                                                                                          |
| Request > Headers | Add the following key-value pairs: • X-CLIENT-SSL-CN : %DOWNSTREAM_PEER_SUBJECT% • X-CLIENT-SSL-SAN : %DOWNSTREAM_PEER_URI_SAN% • X-CLIENT-SSL-ISSUER : %DOWNSTREAM_PEER_ISSUER% |
| Service           | Add the name and port of the Service you want to ex- pose.                                                                                                                       |
- a. Replace the placeholders and export the following values as environment variables:
- b. Create APIRule CR that adds the X-CLIENT-SSL headers to incoming requests:
```
export CLIENT_ROOT_CA_CRT_FILE=<CLIENT_ROOT_CA_CRT_FILE> export CLIENT_CERT_CN=<COMMON_NAME> export CLIENT_CERT_ORG=<ORGANIZATION> export CLIENT_CERT_CRT_FILE=<CLIENT_CERT_CRT_FILE> export CLIENT_CERT_KEY_FILE=<CLIENT_CERT_KEY_FILE> export NAMESPACE=<YOUR_NAMESPACE> export DOMAIN_NAME=<DOMAIN_TO_EXPOSE_WORKLOADS> export GATEWAY=<GATEWAY_NAMESPACE>/<GATEWAY_NAME>
```
```
cat <<EOF | kubectl apply -f apiVersion: gateway.kyma-project.io/v2 kind: APIRule metadata: name: {APIRULE_NAME} namespace: {APIRULE_NAMESPACE} spec: gateway: {GATEWAY_NAMESPACE}/{GATEWAY_NAME} hosts: - {SUBDOMAIN}.{DOMAIN} rules: - methods: - GET noAuth: true path: /* timeout: 300 request: headers: X-CLIENT-SSL-CN: '%DOWNSTREAM_PEER_SUBJECT%' X-CLIENT-SSL-ISSUER: '%DOWNSTREAM_PEER_ISSUER%' X-CLIENT-SSL-SAN: '%DOWNSTREAM_PEER_URI_SAN%' service: name: {SERVICE_NAME} port: {SERVICE_PORT} EOF
```
## Results
To call the secured endpoints of your Service, send a GET with the client certificate that you used to create your Gateway
```
curl --key ${CLIENT_CERT_KEY_FILE} \ --cert ${CLIENT_CERT_CRT_FILE} \ --cacert ${CLIENT_ROOT_CA_CRT_FILE} \ -ik -X GET https://httpbin-vs.$DOMAIN_TO_EXPOSE_WORKLOADS/headers
```
If successful, the call returns the 200 OK response code. If you call the Service without the proper certificates or with invalid ones, you get the error 403 Forbidden .