--- title: Terminate TLS however (and wherever) you want with... description: ngrok introduces the terminate-tls Traffic Policy action, consolidating TLS termination and mTLS configuration into a single declarative config engine.... canonical: https://daily.dev/posts/terminate-tls-however-and-wherever-you-want-with-traffic-policy-ydne5rj4t twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Terminate TLS however (and wherever) you want with Traffic Policy | daily.dev og:description: ngrok introduces the terminate-tls Traffic Policy action, consolidating TLS termination and mTLS configuration into a single declarative config engine.... og:url: https://daily.dev/posts/terminate-tls-however-and-wherever-you-want-with-traffic-policy-ydne5rj4t og:image: https://api.daily.dev/og/posts/ydNE5rJ4t.png og:image:alt: Terminate TLS however (and wherever) you want with Traffic Policy og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Terminate TLS however (and wherever) you want with Traffic Policy **[ngrok Blog](https://daily.dev/sources/ngrok)** · 7 min read · 0 upvotes · 0 comments ## Summary ngrok introduces the terminate-tls Traffic Policy action, consolidating TLS termination and mTLS configuration into a single declarative config engine. Developers can now choose where TLS is terminated—at ngrok's cloud, at the agent, or at the upstream service—supporting end-to-end encryption scenarios. The post covers custom certificate usage, enabling mTLS in minutes, TLS version preferences (TLS 1.3 with TLS 1.2 fallback), and routing based on SNI connection data. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I enable mTLS with ngrok using the terminate-tls Traffic Policy action? You paste your CA certificate into a Traffic Policy file and configure the terminate-tls action to require clients to include client.crt and client.key files with requests. This can be applied to a single agent endpoint or a cloud endpoint to require valid client certificates across all services, and setup takes under a minute if certificates already exist. _daily.dev surfaces practical setup guides like this for engineers wiring up mTLS on their gateways._ ### Where can ngrok terminate TLS connections and what are the tradeoffs? ngrok can terminate TLS at its own cloud service, at the local agent, or leave it to the upstream service, which is the default for TCP or TLS endpoints. Terminating at ngrok's service simplifies certificate management and speeds up connections via its global load balancer, while terminating at the agent or upstream service preserves end-to-end encryption so ngrok's network never sees payloads. _engineers weighing TLS termination tradeoffs can track infrastructure changes like this on daily.dev._ ### What TLS versions does ngrok support when terminating connections at its service? ngrok prefers TLS 1.3 with fallback support for TLS 1.2 for broader client compatibility. TLS 1.3 requires only one round trip for the initial handshake compared to two in TLS 1.2, reducing latency, and it also allows clients to resume a previous connection without a new handshake. _daily.dev helps developers stay current on TLS version support decisions across the tools they rely on._ --- Tags: [#security](https://daily.dev/tags/security), [#devtools](https://daily.dev/tags/devtools), [#api-gateway](https://daily.dev/tags/api-gateway) [View this post on daily.dev](https://daily.dev/posts/terminate-tls-however-and-wherever-you-want-with-traffic-policy-ydne5rj4t) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Terminate TLS however (and wherever) you want with Traffic Policy","url":"https://daily.dev/posts/terminate-tls-however-and-wherever-you-want-with-traffic-policy-ydne5rj4t","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/terminate-tls-however-and-wherever-you-want-with-traffic-policy-ydne5rj4t"},"datePublished":"2026-08-23T07:21:03.761Z","dateModified":"2026-08-23T07:26:26.414Z","description":"ngrok introduces the terminate-tls Traffic Policy action, consolidating TLS termination and mTLS configuration into a single declarative config engine....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1a2cd6efab3dd34f56949a5477c71880?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1a2cd6efab3dd34f56949a5477c71880?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/terminate-tls-however-and-wherever-you-want-with-traffic-policy-ydne5rj4t","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devtools,api-gateway","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"Terminate TLS however (and wherever) you want with Traffic Policy"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/terminate-tls-however-and-wherever-you-want-with-traffic-policy-ydne5rj4t#faq","mainEntity":[{"@type":"Question","name":"How do I enable mTLS with ngrok using the terminate-tls Traffic Policy action?","acceptedAnswer":{"@type":"Answer","text":"You paste your CA certificate into a Traffic Policy file and configure the terminate-tls action to require clients to include client.crt and client.key files with requests. This can be applied to a single agent endpoint or a cloud endpoint to require valid client certificates across all services, and setup takes under a minute if certificates already exist. daily.dev surfaces practical setup guides like this for engineers wiring up mTLS on their gateways."}},{"@type":"Question","name":"Where can ngrok terminate TLS connections and what are the tradeoffs?","acceptedAnswer":{"@type":"Answer","text":"ngrok can terminate TLS at its own cloud service, at the local agent, or leave it to the upstream service, which is the default for TCP or TLS endpoints. Terminating at ngrok's service simplifies certificate management and speeds up connections via its global load balancer, while terminating at the agent or upstream service preserves end-to-end encryption so ngrok's network never sees payloads. engineers weighing TLS termination tradeoffs can track infrastructure changes like this on daily.dev."}},{"@type":"Question","name":"What TLS versions does ngrok support when terminating connections at its service?","acceptedAnswer":{"@type":"Answer","text":"ngrok prefers TLS 1.3 with fallback support for TLS 1.2 for broader client compatibility. TLS 1.3 requires only one round trip for the initial handshake compared to two in TLS 1.2, reducing latency, and it also allows clients to resume a previous connection without a new handshake. daily.dev helps developers stay current on TLS version support decisions across the tools they rely on."}}]} ```