---
title: "POST /v1/{+parent}/serverTlsPolicies"
method: POST
path: "/v1/{+parent}/serverTlsPolicies"
tags: ["projects"]
---

# POST /v1/{+parent}/serverTlsPolicies

`POST /v1/{+parent}/serverTlsPolicies`

Creates a new ServerTlsPolicy in a given project and location.

## Path parameters

- `parent` string, required

## Query parameters

- `serverTlsPolicyId` string

## Request body

- ServerTlsPolicy — ServerTlsPolicy is a resource that specifies how a server should authenticate incoming requests. This resource itself does not affect configuration unless it is attached to a target HTTPS proxy or endpoint config selector resource. ServerTlsPolicy in the form accepted by Application Load Balancers can be attached only to TargetHttpsProxy with an `EXTERNAL`, `EXTERNAL_MANAGED` or `INTERNAL_MANAGED` load balancing scheme. Traffic Director compatible ServerTlsPolicies can be attached to EndpointPolicy and TargetHttpsProxy with Traffic Director `INTERNAL_SELF_MANAGED` load balancing scheme.
  - `updateTime` string, google-datetime — Output only. The timestamp when the resource was updated.
  - `mtlsPolicy` MTLSPolicy — Specification of the MTLSPolicy.
    - `clientValidationMode` 'CLIENT_VALIDATION_MODE_UNSPECIFIED' | 'ALLOW_INVALID_OR_MISSING_CLIENT_CERT' | 'REJECT_INVALID' — When the client presents an invalid certificate or no certificate to the load balancer, the `client_validation_mode` specifies how the client connection is handled. Required if the policy is to be used with the Application Load Balancers. For Traffic Director it must be empty.
    - `clientValidationCa` ValidationCA[] — Required if the policy is to be used with Traffic Director. For Application Load Balancers it must be empty. Defines the mechanism to obtain the Certificate Authority certificate to validate the client certificate.
      - `grpcEndpoint` GoogleCloudNetworksecurityV1GrpcEndpoint — Specification of the GRPC Endpoint.
        - `targetUri` string — Required. The target URI of the gRPC endpoint. Only UDS path is supported, and should start with "unix:".
      - `certificateProviderInstance` CertificateProviderInstance — Specification of a TLS certificate provider instance. Workloads may have one or more CertificateProvider instances (plugins) and one of them is enabled and configured by specifying this message. Workloads use the values from this message to locate and load the CertificateProvider instance configuration.
        - `pluginInstance` string — Required. Plugin instance name, used to locate and load CertificateProvider instance configuration. Set to "google_cloud_private_spiffe" to use Certificate Authority Service certificate provider instance.
    - `clientValidationTrustConfig` string — Reference to the TrustConfig from certificatemanager.googleapis.com namespace. If specified, the chain validation will be performed against certificates configured in the given TrustConfig. Allowed only if the policy is to be used with Application Load Balancers.
  - `name` string — Required. Name of the ServerTlsPolicy resource. It matches the pattern `projects/*/locations/{location}/serverTlsPolicies/{server_tls_policy}`
  - `allowOpen` boolean — This field applies only for Traffic Director policies. It is must be set to false for Application Load Balancer policies. Determines if server allows plaintext connections. If set to true, server allows plain text connections. By default, it is set to false. This setting is not exclusive of other encryption modes. For example, if `allow_open` and `mtls_policy` are set, server allows both plain text and mTLS connections. See documentation of other encryption modes to confirm compatibility. Consider using it if you wish to upgrade in place your deployment to TLS while having mixed TLS and non-TLS traffic reaching port :80.
  - `description` string — Free-text description of the resource.
  - `createTime` string, google-datetime — Output only. The timestamp when the resource was created.
  - `labels` object — Set of label tags associated with the resource.
  - `serverCertificate` GoogleCloudNetworksecurityV1CertificateProvider — Specification of certificate provider. Defines the mechanism to obtain the certificate and private key for peer to peer authentication.
    - `grpcEndpoint` GoogleCloudNetworksecurityV1GrpcEndpoint — Specification of the GRPC Endpoint.
      - `targetUri` string — Required. The target URI of the gRPC endpoint. Only UDS path is supported, and should start with "unix:".
    - `certificateProviderInstance` CertificateProviderInstance — Specification of a TLS certificate provider instance. Workloads may have one or more CertificateProvider instances (plugins) and one of them is enabled and configured by specifying this message. Workloads use the values from this message to locate and load the CertificateProvider instance configuration.
      - `pluginInstance` string — Required. Plugin instance name, used to locate and load CertificateProvider instance configuration. Set to "google_cloud_private_spiffe" to use Certificate Authority Service certificate provider instance.

## Response `200`

Successful response

---

[API](https://skmtc.net/google/apis/networksecurity.md) · [All operations](https://skmtc.net/google/apis/networksecurity/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/networksecurity/versions/4afd54463fe6/schema)