tencent cloud

Cloud Native Intelligent Gateway

DokumentasiCloud Native Intelligent GatewayAI GatewayOperation GuideMCP ManagementMCP Service Backend TLS/mTLS Encryption

MCP Service Backend TLS/mTLS Encryption

Unduh
Mode fokus
Ukuran font
Terakhir diperbarui: 2026-09-22 18:47:45
Diterjemahkan oleh AI

Feature Overview

It supports establishing a one-way TLS or mTLS mutual authentication encrypted channel between the gateway and backend services to prevent link eavesdropping and man-in-the-middle attacks. Certificates are uniformly referenced from the Tencent Cloud SSL Certificates management platform. The gateway side does not support manual certificate upload. Certificate application, renewal, and revocation must all be completed on the SSL Certificates management platform.

Prerequisites

Gateway version 3.9.6 or later (when the CA certificate type or the client certificate purpose is used).
Prepare the server certificate (backend server certificate) and the CA certificate (trust chain certificate) on the Tencent Cloud SSL Certificates management platform.
Supported scope:
MCP service/HTTP to MCP service: only the scenario where backend type = domain name/IP and protocol = HTTPS.
Not supported: TKE, MCP registry, virtual MCP Server, Agent API, and model services.

Scenario 1: Creating a Certificate

1. Log in to the AI Gateway console and go to the target gateway instance.
2. In the left sidebar, select Certificate Management and click Create Certificate.
3. Enter the certificate information:
Parameter
Required
Value Range/Default Value
Description
Certificate Name
Yes
1-80 characters, supporting Chinese, English, digits, underscores, hyphens ("-"), and periods.
Custom name.
Certificate Source
Yes
Tencent Cloud SSL Certificates Management Platform
Fixed item. Click to go to the SSL platform.
Certificate Type
Yes
SVR (Server Certificate) / CA (CA Certificate)
Server certificates are used to bind domains and provide HTTPS access. CA certificates are used to verify backend service certificates (mTLS). The certificate type must match the actual type on the SSL platform; otherwise, an error is reported.
Certificate Usage
No, default to "Server".
SERVER (Server Domain Certificate) / CLIENT (mTLS Client Certificate)
Selectable only when Certificate Type=SVR. The CLIENT purpose requires gateway version 3.9.6 or later and does not support domain binding.
Select Certificate
Yes
Existing certificates on the SSL platform
Search by ID/remarks/domain is supported. Expired certificates cannot be selected.
Bind Domain
No
-
Required only for the SERVER purpose.
4. After you confirm the submission, you can view the status, type, purpose, bound domain name, and number of references in the certificate list.

Scenario 2: Configuring Upstream TLS for MCP Services

1. Go to the target MCP service list page, edit Backend Service Configuration, and expand Advanced Configuration.
2. Configure the following parameters:
Parameter
Required
Value Range/Default Value
Description
Verify Certificate or Not
No, verification disabled by default.
Enable/Disable
When this option is disabled, the behavior is the same as the current default (no verification, compatible with self-signed certificates).
Client Certificate
No
Associated certificates with Certificate Type=SVR + Certificate Purpose=CLIENT
After configuration, mTLS mutual authentication is enabled. Certificate verification must be enabled.
Trusted CA Certificate
No
Associated certificates with Certificate Type=CA, up to 8
When configuring a client certificate, configure at least one trusted CA certificate at the same time.
3. The configuration takes effect immediately after saving, and no service restart is required.
Topik sebelumnya: MCP Service ManagementTopik selanjutnya: MCP Server Online/Offline and Health Check Management

Bantuan dan Dukungan

Apakah halaman ini membantu?

masukan

Search
    Enter keywords to search documentation