An AI CA certificate contains the PEM-encoded public certificate of a trusted Certificate Authority. This is used as the root CA to verify the validity of AI Certificates and AI Data Plane Certificates.
AI Gateway verifies certificates by default and will fail to push an insecure configuration to a Data Plane.
The following example registers a CA certificate and creates an AI CA Certificate entity:
To create an AI CA Certificate, call the Konnect AI Gateway API’s /ca-certificates endpoint.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/ca-certificates \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "my-root-ca",
"cert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n"
}
'Make sure to replace the following placeholders with your own values:
region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
AIGatewayId: The id of the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
How is an AI CA Certificate different from a Kong Gateway CA Certificate?
Both hold a PEM-encoded certificate used to validate TLS certificates, but they’re separate entities.
What’s the difference between an AI Certificate and an AI CA Certificate?
An AI CA Certificate represents a trusted certificate authority, carries no private key, and is used to verify the certificate a client or an upstream server presents. An AI Certificate is an identity the data plane uses itself: it carries a private key and is presented to complete a TLS handshake.