Gateway certificate

The gateway certificate protects the console and the API, and every connection a fleet makes to Streamtime. Fleets verify it on every connection.

Choice	What happens
Generate a new certificate from the Streamtime CA (recommended)	Streamtime signs a certificate with your installation’s own CA, covering every name it needs. Fleets trust that CA, so a new certificate never needs a fleet change
Use my own certificate	You upload a certificate, its intermediates and its private key. It must cover every name Streamtime needs; Streamtime refuses one that doesn’t and names what is missing

With the highly available Helm install, the certificate comes from cert-manager (Let’s Encrypt) instead, and fleets trust Let’s Encrypt’s public roots.

Before you start

• Your own certificate: the certificate in PEM format, the intermediate certificates from your CA (fleets need the full chain), and the private key without a password.
• Trusting the Streamtime CA on your machines: the settings page shows the commands for macOS, Windows and Linux.

The API examples below share this setup:

HTTP Python TypeScript Go

export STREAMTIME_TOKEN=<your-access-token>
export API=https://api.example.com/organizations/<org>

import os
from streamtime_sdk.client import AuthenticatedClient

client = AuthenticatedClient(
    base_url="https://api.example.com",
    token=os.environ["STREAMTIME_TOKEN"],
)
ORG = "<org>"

Uses the generated client in streamtime-sdk/typescript/client.

import { client } from "./client/client.gen";

client.setConfig({
  baseUrl: "https://api.example.com",
  headers: { Authorization: `Bearer ${process.env.STREAMTIME_TOKEN}` },
});
const org = "<org>";

package main

import (
    "bytes"
    "crypto/rand"
    "encoding/hex"
    "encoding/json"
    "net/http"
    "os"
)

const api = "https://api.example.com/organizations/<org>"

// newKey returns a random idempotency key.
func newKey() string {
    b := make([]byte, 16)
    rand.Read(b)
    return hex.EncodeToString(b)
}

// call sends one request with the access token and a JSON body (or none).
// An optional idempotency key is sent as the Idempotency-Key header.
func call(method, path string, body any, idempotencyKey ...string) (*http.Response, error) {
    var buf bytes.Buffer
    if body != nil {
        if err := json.NewEncoder(&buf).Encode(body); err != nil {
            return nil, err
        }
    }
    req, err := http.NewRequest(method, api+path, &buf)
    if err != nil {
        return nil, err
    }
    req.Header.Set("Authorization", "Bearer "+os.Getenv("STREAMTIME_TOKEN"))
    req.Header.Set("Content-Type", "application/json")
    if len(idempotencyKey) > 0 {
        req.Header.Set("Idempotency-Key", idempotencyKey[0])
    }
    return http.DefaultClient.Do(req)
}

Replace the gateway certificate

UI API CLI MCP

1. Go to Settings → Connectivity. The Gateway Certificate card shows the current certificate.
2. Choose Generate a new certificate from the Streamtime CA (recommended) and, optionally, add Extra hostnames or IP addresses that people use to reach Streamtime. Or choose Use my own certificate and paste Certificate, Intermediate certificates and Private key, then select Validate.
3. Turn on Tell browsers to always use HTTPS for these addresses (HSTS) only when every user’s browser trusts the certificate: a browser that has seen it won’t let anyone click past a certificate warning.
4. Select Replace certificate. The gateway uses it after it restarts.

HTTP Python TypeScript Go

# Generate a new certificate with an extra name.
curl -X PUT "$API/settings/builtin-certificate/" \
  -H "Authorization: Bearer $STREAMTIME_TOKEN" -H "Content-Type: application/json" \
  -d '{"source": "generated", "extra_names": ["streamtime.example.com"]}'

# Or upload your own.
jq -n --rawfile cert cert.pem --rawfile chain chain.pem --rawfile key key.pem \
  '{source: "uploaded", cert_pem: $cert, chain_pem: $chain, key_pem: $key}' |
curl -X PUT "$API/settings/builtin-certificate/" \
  -H "Authorization: Bearer $STREAMTIME_TOKEN" -H "Content-Type: application/json" \
  -d @-

GET $API/settings/builtin-certificate/ shows the current certificate; the private key is never returned. A 400 names the missing names or the problem with an uploaded certificate.

from streamtime_sdk.api.settings import settings_builtin_certificate_update
from streamtime_sdk.models import BuiltinCertificateSettingWrite

settings_builtin_certificate_update.sync(
    ORG,
    client=client,
    body=BuiltinCertificateSettingWrite.from_dict(
        {"source": "generated", "extra_names": ["streamtime.example.com"]}
    ),
)

import { settingsBuiltinCertificateUpdate } from "./client";

await settingsBuiltinCertificateUpdate({
  path: { org_identifier: org },
  body: { source: "generated", extra_names: ["streamtime.example.com"] },
});

resp, err := call("PUT", "/settings/builtin-certificate/", map[string]any{
    "source":      "generated",
    "extra_names": []string{"streamtime.example.com"},
})
if err != nil {
    return err
}
defer resp.Body.Close()

Not available in the CLI yet. Use the console or the API.

Not available in MCP yet.

Fleet certificates are separate

The certificate on your Kafka endpoints is the fleet certificate, one wildcard per fleet. See DNS & certificates.