Skip to main content

TLS / HTTPS

The AI Optimizer Server and AI Optimizer Client can serve HTTPS. Enable TLS with AIO_SERVER_SSL or AIO_CLIENT_SSL, then use the corresponding *_SSL_CERT_FILE and *_SSL_KEY_FILE environment variables for provided certificates.

Choose one HTTP/TLS option for each component:

  • HTTP: The default for local desktop experimentation.
  • Generated self-signed certificate: Encrypts local development traffic and prompts a browser trust warning.
  • Provided certificate: Use a certificate and key issued or managed by your organization for deployments reached by other users.

Generated Self-Signed Certificates​

The AI Optimizer can automatically generate self-signed certificates for local deployments. The generated certificate is valid for localhost.

Browser warning

Browsers show a warning for a self-signed certificate. It is intended for local development; use a certificate trusted by the browser or operating system for a shared deployment.

To generate certificates automatically, set one SSL variable for the component and leave its certificate paths unset:

# API Server
AIO_SERVER_SSL=true

# AI Optimizer Client
AIO_CLIENT_SSL=true

Then run its matching command:

# API Server
uv run python src/entrypoint.py server

# AI Optimizer Client
uv run python src/entrypoint.py client

A localhost certificate and key will be placed at <project-root>/tmp/ssl/ for bare-metal installations and /app/tmp/ssl/ in the container image.

Provided Certificates​

To use your own certificates, provide both a PEM-encoded certificate and its private key. The certificate must cover the hostname users connect to, and the process must be able to read both files.

If either path is omitted and *_SSL=true, the AI Optimizer generates a self-signed pair instead.

API Server​

AIO_SERVER_SSL=true
AIO_SERVER_SSL_CERT_FILE=/path/to/cert.pem
AIO_SERVER_SSL_KEY_FILE=/path/to/key.pem

AI Optimizer Client​

AIO_CLIENT_SSL=true
AIO_CLIENT_SSL_CERT_FILE=/path/to/cert.pem
AIO_CLIENT_SSL_KEY_FILE=/path/to/key.pem

All-in-One Container​

Pass the required variables at container startup, and mount provided certificate files into the container:

podman run \
  --env-file src/.env.dev \
  -v /path/to/tls:/app/tls:ro \
  -p 8501:8501 \
  -it --rm localhost/ai-optimizer-aio:dev

In the environment file, use the mounted paths, for example:

AIO_CLIENT_SSL=true
AIO_CLIENT_SSL_CERT_FILE=/app/tls/cert.pem
AIO_CLIENT_SSL_KEY_FILE=/app/tls/key.pem

Kubernetes and Helm​

For ingress, gateway, and direct Client-pod TLS in a Helm deployment, see Kubernetes / Helm.