配置自定义 TLS 证书

本指南介绍如何在 LangSmith 中配置 TLS。首先挂载内部证书颁发机构（CA），使部署在系统范围内信任正确的根证书，以用于数据库或外部服务调用。然后你可以配置 Playground 专用的 mTLS，以便与受支持的模型提供商安全通信。

本页涵盖：

• 挂载内部证书颁发机构（CA），在系统范围内为数据库连接和 Playground 模型调用启用 TLS
• 使用 Playground 专用 TLS 设置，为与受支持模型提供商进行 mTLS 提供客户端证书/密钥

为 TLS 挂载内部 CA

NOTE

你必须使用 Helm chart 0.11.9 或更高版本，才能通过以下配置挂载内部 CA。

使用此方法可让 LangSmith 在系统范围内信任内部/公共 CA（用于 Playground 模型调用和数据库/外部服务连接）。

1. 创建一个文件，包含数据库和外部服务 TLS 所需的所有 CA。如果你的部署直接（不经过代理）与 beacon.langchain.com 通信，请确保包含一个公共受信任 CA。所有证书应在此文件中拼接，证书之间留一个空行。

   -----BEGIN CERTIFICATE-----
   <PUBLIC_CA>
   -----END CERTIFICATE-----
   
   -----BEGIN CERTIFICATE-----
   <INTERNAL_CA>
   -----END CERTIFICATE-----
   
   ...

2. Create a Kubernetes secret with a key containing the contents of this file.

   kubectl create secret generic <SECRET_NAME> --from-file=<SECRET_KEY>=<CA_BUNDLE_FILE_PATH> -n <NAMESPACE>

3. If using custom CA for TLS with your databases and other external services, provide the following values to your LangSmith helm chart:

   config:
     customCa:
       secretName: <SECRET_NAME> # The name of the secret created in step 2.
       secretKey: <SECRET_KEY> # The key in the secret containing the CA bundle.
   
   clickhouse:
     external:
       tls: true # Only enable if you want TLS for Clickhouse.
   postgres:
     external:
       customTls: true # Only enable if you want TLS for Postgres.

4. Make sure to use TLS supported connection strings:
   • Postgres: Add ?sslmode=verify-full&sslrootcert=system to the end.
   • Redis: Use rediss:// instead of redis:// as the prefix.

Use custom TLS certificates for model providers

NOTE

This feature is currently only available for the following model providers:

• Azure OpenAI
• OpenAI
• Custom (our custom model server). Refer to the custom model server documentation for more information.

These TLS settings apply to all invocations of the selected model providers (including Online Evaluation). Use them when the provider requires mutual TLS (client cert/key) or when you must override trust with a specific CA for provider calls. They complement the internal CA bundle configured above.

You can use custom TLS certificates to connect to model providers in the Playground. This is useful if you are using a self-signed certificate, a certificate from a custom certificate authority, or mutual TLS authentication.

To use custom TLS certificates, set the following environment variables. See the self-hosted overview for more information on how to configure application settings.

• [Optional] LANGSMITH_PLAYGROUND_TLS_KEY: The private key in PEM format. This must be a file path (for a mounted volume). This is usually only necessary for mutual TLS authentication.
• [Optional] LANGSMITH_PLAYGROUND_TLS_CERT: The certificate in PEM format. This must be a file path (for a mounted volume). This is usually only necessary for mutual TLS authentication.
• [Optional] LANGSMITH_PLAYGROUND_TLS_CA: The custom certificate authority (CA) certificate in PEM format. This must be a file path (for a mounted volume). Use this to mount CAs only if you're using a helm version below 0.11.9; otherwise, use the Mount internal CAs for TLS section above.

Once you have set these environment variables, enter the Playground Settings page and select the Provider that requires custom TLS certificates. Set your model provider configuration as usual, and the custom TLS certificates will be used when connecting to the model provider.

---