AgentCore Gateway supports private TLS certificates for VPC endpoints
AgentCore Gateway now supports TLS certificates signed by private certificate authorities on MCP, OpenAPI, and HTTP proxy targets, enabling secure connections to targets using TLS certificates from your own private CA.
Amazon Bedrock AgentCore Gateway now supports TLS certificates signed by private CAs for MCP, OpenAPI, and HTTP proxy targets, enabling secure connections to gateways using certificates issued by your own private CA. It establishes native connections to private endpoints within a VPC without using an Application Load Balancer, and allows registering private CA certificates for gateway targets running on Amazon VPC Lattice. The gateway retrieves PEM-encoded CA certificates from Amazon S3 or AWS Secrets Manager for use as trust anchors in outbound TLS connections. This private CA support is available for MCP server, OpenAPI, and HTTP proxy (pass-through) targets in all regions where both AgentCore Gateway and Amazon VPC Lattice are offered. For more information, see the AgentCore developer guide.
Why it matters
This update is important for developers and security professionals who need to securely connect to private endpoints within their VPC.