OptionalcaCA certificate(s) (PEM) to trust. Omit to use the system trust store — the right choice for Restate Cloud's public endpoints.
OptionalcertClient certificate (PEM) for mutual TLS.
OptionalkeyClient key (PEM) for mutual TLS.
OptionalrejectVerify the server certificate. Default true.
OptionalservernameSNI / certificate-verification name. Defaults to the hostname being dialed (for region/SRV discovery, the SRV target hostname).
TLS options for the outbound tunnel connection.
The tunnel always offers ALPN
h2and requires TLS peers to negotiate it; omit these options to use the system trust store and SNI for the dialed host. There is no user-facing ALPN option because the tunnel protocol requires HTTP/2.