AI CA Certificates

Uses: AI Gateway kongctl Konnect API

What is an AI CA Certificate

An AI CA certificate contains the PEM-encoded public certificate of a trusted Certificate Authority. This is used as the root CA to verify the validity of AI Certificates and AI Data Plane Certificates.

AI Gateway verifies certificates by default and will fail to push an insecure configuration to a Data Plane.

Set up an AI CA Certificate

The following example registers a CA certificate and creates an AI CA Certificate entity:

To create an AI CA Certificate, call the Konnect AI Gateway API’s /ca-certificates endpoint.

curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/ca-certificates \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "my-root-ca",
      "cert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n"
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
AIGatewayId: The id of the AI Gateway.

See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.

kongctl

ca_certificate.yaml

Copied!

ai_gateway_ca_certificates:
  - ref: my-root-ca
    ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
    name: my-root-ca
    cert: |
      -----BEGIN CERTIFICATE-----
      ...
      -----END CERTIFICATE-----

Make sure to replace the following placeholders with your own values:

AI_GATEWAY_ID: The id of your AI Gateway.

Schema

FAQs

How is an AI CA Certificate different from a Kong Gateway CA Certificate?

Both hold a PEM-encoded certificate used to validate TLS certificates, but they’re separate entities.

What’s the difference between an AI Certificate and an AI CA Certificate?

An AI CA Certificate represents a trusted certificate authority, carries no private key, and is used to verify the certificate a client or an upstream server presents. An AI Certificate is an identity the data plane uses itself: it carries a private key and is presented to complete a TLS handshake.

AI CA Certificates

What is an AI CA Certificate

Set up an AI CA Certificate

Schema

FAQs

Help us make these docs great!

Still need help?