AI Data Plane Certificates

A Data Plane Certificate is an AI Gateway entity that registers a public X.509 certificate as a trusted client identity for an AI Gateway. Data planes presenting the matching private key during the mTLS handshake are allowed to connect; data planes without a matching registered certificate are rejected.

Each Data Plane Certificate belongs to exactly one AI Gateway. An AI Gateway can have multiple registered certificates so that you can issue one per data plane fleet, rotate keys without downtime, or revoke trust for a subset of data planes independently.

Data Plane Certificates are managed through the Konnect AI Gateway API, the Konnect UI, or Terraform:

The AI Gateway acts as the control plane in a CP/DP topology. Each data plane presents a client certificate during the TLS handshake, and the AI Gateway accepts the connection only if the presented certificate matches one that has been registered as a Data Plane Certificate on that AI Gateway.

Only the public certificate is registered with the AI Gateway. The private key is generated and held on the data plane side; it never leaves the data plane host.

 
sequenceDiagram
    participant DP as Data Plane
    participant CP as AI Gateway (Control Plane)

    Note over DP: Holds private key locally
(never sent over the network)
    DP->>CP: TLS handshake with client certificate
    Note over CP: Compare presented certificate against
registered Data Plane Certificates
    alt Certificate matches a registered entry
        CP-->>DP: TLS handshake completes
        DP->>CP: Receive configuration and stream telemetry
    else No matching registered certificate
        CP-->>DP: Connection rejected
    end
  

Data Plane Certificates support create, list, get, and delete operations. There is no update endpoint, the certificate body is immutable.

To rotate a certificate without downtime:

1. Register the new certificate as an additional Data Plane Certificate on the AI Gateway.
2. Reconfigure the data planes to present the new certificate and key.
3. Verify that data planes have reconnected with the new identity.
4. Delete the old Data Plane Certificate.

Deleting a Data Plane Certificate immediately invalidates the trust for any data plane still using it. Existing connections are dropped and reconnect attempts using the deleted certificate are rejected.