A city permitting API must present TLS credentials the ops team can rotate for that service alone. The shared ingress still uses a platform default certificate nobody on the app team can replace. Which configuration choice satisfies an application-specific SSL requirement?

Application-specific SSL means the civic service presents credentials the app team can rotate for that hostname alone. For the city permitting API, installing a certificate and private key issued for the permitting API hostname on that app’s process or ingress satisfies the requirement: identity matches permits’ FQDN, and ops can replace material without waiting on an unrelated platform default. Shared ingress defaults that nobody on the app team can replace do not meet an application-owned TLS requirement.

Leaving the platform default certificate in place and documenting yearly cluster-owner rotation fails because the app team cannot meet its own rotation SLA or hostname identity needs. Terminating TLS only on an upstream campus VPN concentrator and skipping an app certificate fails citizen HTTPS to the API hostname and leaves the app without its own server identity. Relying on HTTP Basic credentials in the URL so clients ignore certificate identity fails confidentiality, phishing resistance, and modern browser/API client trust models.

Exam caveat: a dedicated secret on a shared ingress that serves the correct SAN for the permitting hostname still counts as configuring the application certificate path—ownership and hostname match matter more than which process file path holds the PEM. Do not confuse API TLS with campus VPN or MACsec.

Operational check: confirm openssl/s_client (or browser) shows the permitting hostname in SAN, that rotation updates only that secret, and that clients fail closed if the wrong default cert is accidentally remounted.