AI SNIs

An AI SNI (Server Name Indication) maps a hostname to an AI Certificate registered on an AI Gateway. When a client opens a TLS connection to a data plane, the data plane reads the hostname from the TLS ClientHello message and presents the AI Certificate that the matching AI SNI points at. This lets a single data plane serve several hostnames, each with its own AI Certificate, on the same listener.

Each AI SNI belongs to exactly one AI Gateway, alongside the AI Certificate it references.

The mapping is many-to-one: one AI Certificate can be associated with many hostnames, so you create one AI SNI per hostname (or one wildcard AI SNI per subdomain) and point them all at the same AI Certificate. Use this to expose your LLM, MCP, and A2A traffic on separate hostnames, such as llm.example.com, mcp.example.com, and agents.example.com, while backing them all with a single certificate instead of managing one per hostname.

The hostname field accepts an exact hostname or a hostname with a single wildcard segment at one end, for example:

• llm.example.com matches that hostname only
• *.example.com matches subdomains of example.com
• example.* matches the same name across top-level domains
• *.example.* is rejected

When several AI SNIs could match an incoming hostname, the data plane resolves the AI Certificate in this order:

1. An AI SNI with an exact hostname match
2. An AI SNI with a matching prefix wildcard
3. An AI SNI with a matching suffix wildcard
4. The data plane’s default certificate

An AI SNI references its certificate by name. The AI Certificate must include a valid private key, since the data plane uses it to complete the TLS handshake.

There are two ways to create an AI SNI:

• Standalone: POST to /v1/ai-gateways/{aiGatewayId}/snis with an AI Certificate name in the request body. Use this when you’re attaching hostnames to an AI Certificate that already exists.
• Nested under an AI Certificate: POST to /v1/ai-gateways/{aiGatewayId}/certificates/{certificateIdOrName}/snis. The AI Certificate comes from the path, so the request body has no certificate field.

The following example creates an AI SNI that maps every subdomain of example.com to an AI Certificate named my-tls-cert.

The certificate field takes the name of an existing AI Certificate entity. For more information, see AI Certificates.

To create an AI SNI, call the Konnect AI Gateway API’s /snis endpoint.

curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/snis \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "llm-example-com",
      "display_name": "LLM API - example.com",
      "hostname": "*.example.com",
      "certificate": "my-tls-cert"
    }
    '

Make sure to replace the following placeholders with your own values:

• region: Geographic region where your Kong Konnect is hosted and operates.

• KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.

• AIGatewayId: The id of the AI Gateway.

See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.