TLS

AI Gateway is client-facing, so TLS here encrypts the inbound connection from AI agents, not an outbound connection to some downstream service. Insert a tls server binding between the tcp server binding and the http server binding in zilla.yaml, so Zilla terminates TLS at the edge before the request reaches the http server and mcp server bindings. For client certificate authentication on top of encryption, see mTLS.

Terminating Inbound TLS

Configure a filesystem vault with AI Gateway's private key and signed certificate in its keystore, and reference it, along with the certificate alias to present, from the tls server binding:

vaults:
  server_vault:
    type: filesystem
    options:
      keys:
        store: ${{env.KEYSTORE_PATH}}
        type: ${{env.KEYSTORE_TYPE}}
        password: ${{env.KEYSTORE_PASSWORD}}

bindings:
  north_tcp_server:
    type: tcp
    kind: server
    options:
      host: 0.0.0.0
      port: 8443
    exit: north_tls_server

  north_tls_server:
    type: tls
    kind: server
    vault: server_vault
    options:
      keys:
        - ${{env.SERVER_CERT_ALIAS}}
      sni:
        - ${{env.SERVER_HOSTNAME}}
    exit: north_http_server

  north_http_server:
    type: http
    kind: server
    options:
      access-control:
        policy: cross-origin
    routes:
      - when:
          - headers:
              ":path": /mcp
        exit: north_mcp_server

  north_mcp_server:
    type: mcp
    kind: server
    exit: north_mcp_proxy

See the tls server binding reference for the full set of options fields, including options.sni for serving multiple hostnames from the same binding.