TLS Configuration

Via SDK

Use the ssl feature on the HTTP backend crate:

[dependencies]
rust-mcp-axum = { version = "1.0", features = ["ssl"] }

let server = create_axum_server(
    server_info,
    handler.to_mcp_server_handler(),
    AxumServerOptions {
        enable_ssl: true,
        ssl_cert_path: Some("path/to/cert.pem".into()),
        ssl_key_path: Some("path/to/key.pem".into()),
        ..Default::default()
    },
);
server.start().await?;

Both paths must point to existing PEM files - the options are validated at startup and the server fails to start otherwise.

Via Reverse Proxy

Recommended for production - terminate TLS at NGINX, Caddy, or Cloudflare:

server {
    listen 443 ssl http2;
    server_name mcp.example.com;

    ssl_certificate /etc/letsencrypt/live/mcp.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mcp.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }
}

Via Let's Encrypt

# Install certbot and get a certificate
certbot certonly --standalone -d mcp.example.com