@@ -53,6 +53,12 @@ public final class ApiServerConfig {
   private final Set<String> allowedOrigins;
   private final int threadPoolSize;
   private final int maxThreadPoolSize;
+  private final boolean enableTls;
+  private final String keystorePath;
+  private final String keystorePassword;
+  private final String keyAlias;
+  private final String[] enabledProtocols;
+  private final String[] enabledCiphers;
 
   private ApiServerConfig(Builder builder) {
     this.port = builder.port;
@@ -66,6 +72,12 @@ private ApiServerConfig(Builder builder) {
             : Collections.emptySet();
     this.threadPoolSize = builder.threadPoolSize;
     this.maxThreadPoolSize = builder.maxThreadPoolSize;
+    this.enableTls = builder.enableTls;
+    this.keystorePath = builder.keystorePath;
+    this.keystorePassword = builder.keystorePassword;
+    this.keyAlias = builder.keyAlias;
+    this.enabledProtocols = builder.enabledProtocols;
+    this.enabledCiphers = builder.enabledCiphers;
   }
 
   /**
@@ -140,6 +152,60 @@ public int getMaxThreadPoolSize() {
     return maxThreadPoolSize;
   }
 
+  /**
+   * Checks if TLS/HTTPS is enabled.
+   *
+   * @return true if TLS is enabled
+   */
+  public boolean isEnableTls() {
+    return enableTls;
+  }
+
+  /**
+   * Returns the keystore file path.
+   *
+   * @return the keystore path, or null if TLS is disabled
+   */
+  public String getKeystorePath() {
+    return keystorePath;
+  }
+
+  /**
+   * Returns the keystore password.
+   *
+   * @return the keystore password, or null if TLS is disabled
+   */
+  public String getKeystorePassword() {
+    return keystorePassword;
+  }
+
+  /**
+   * Returns the key alias in the keystore.
+   *
+   * @return the key alias, or null if TLS is disabled
+   */
+  public String getKeyAlias() {
+    return keyAlias;
+  }
+
+  /**
+   * Returns the enabled TLS protocols.
+   *
+   * @return array of enabled TLS protocol names (e.g., "TLSv1.2", "TLSv1.3")
+   */
+  public String[] getEnabledProtocols() {
+    return enabledProtocols != null ? enabledProtocols.clone() : null;
+  }
+
+  /**
+   * Returns the enabled cipher suites.
+   *
+   * @return array of enabled cipher suite names
+   */
+  public String[] getEnabledCiphers() {
+    return enabledCiphers != null ? enabledCiphers.clone() : null;
+  }
+
   /**
    * Creates a new builder for constructing API server configurations.
    *
@@ -159,6 +225,17 @@ public static class Builder {
     private Set<String> allowedOrigins = new HashSet<>();
     private int threadPoolSize = 20;
     private int maxThreadPoolSize = 200;
+    private boolean enableTls = false;
+    private String keystorePath;
+    private String keystorePassword;
+    private String keyAlias = "server";
+    private String[] enabledProtocols = {"TLSv1.2", "TLSv1.3"};
+    private String[] enabledCiphers = {
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+    };
 
     /**
      * Sets the port to listen on.
@@ -297,12 +374,98 @@ public Builder maxThreadPoolSize(int size) {
       return this;
     }
 
+    /**
+     * Enables TLS/HTTPS for the API server.
+     *
+     * @param enableTls true to enable TLS
+     * @return this builder
+     */
+    public Builder enableTls(boolean enableTls) {
+      this.enableTls = enableTls;
+      return this;
+    }
+
+    /**
+     * Sets the keystore file path for TLS certificates.
+     *
+     * @param keystorePath path to the keystore file
+     * @return this builder
+     */
+    public Builder keystorePath(String keystorePath) {
+      this.keystorePath = keystorePath;
+      return this;
+    }
+
+    /**
+     * Sets the keystore password.
+     *
+     * @param keystorePassword the keystore password
+     * @return this builder
+     */
+    public Builder keystorePassword(String keystorePassword) {
+      this.keystorePassword = keystorePassword;
+      return this;
+    }
+
+    /**
+     * Sets the key alias in the keystore.
+     *
+     * @param keyAlias the alias of the key to use
+     * @return this builder
+     */
+    public Builder keyAlias(String keyAlias) {
+      this.keyAlias = keyAlias;
+      return this;
+    }
+
+    /**
+     * Sets the enabled TLS protocols. Only TLSv1.2+ should be used.
+     *
+     * @param protocols array of protocol names (e.g., "TLSv1.2", "TLSv1.3")
+     * @return this builder
+     */
+    public Builder enabledProtocols(String[] protocols) {
+      this.enabledProtocols = protocols;
+      return this;
+    }
+
+    /**
+     * Sets the enabled cipher suites. Should only include strong ciphers.
+     *
+     * @param ciphers array of cipher suite names
+     * @return this builder
+     */
+    public Builder enabledCiphers(String[] ciphers) {
+      this.enabledCiphers = ciphers;
+      return this;
+    }
+
     /**
      * Builds the ApiServerConfig instance.
      *
+     * <p><strong>BREAKING CHANGE (Issue #366):</strong> As of version 2.0, TLS configuration is
+     * now validated at build time. If you enable TLS ({@code enableTls(true)}), you MUST also
+     * provide a keystore path and password. Invalid TLS configurations will throw
+     * IllegalStateException instead of being silently accepted.
+     *
+     * <p><strong>Migration Guide:</strong>
+     * - If TLS is not needed: explicitly call {@code enableTls(false)} (or rely on default)
+     * - If enabling TLS: provide keystore path and password:
+     *   <pre>{@code
+     * ApiServerConfig.builder()
+     *   .enableTls(true)
+     *   .keystorePath("/path/to/keystore.jks")
+     *   .keystorePassword(System.getenv("KEYSTORE_PASSWORD"))
+     *   .build()
+     * }</pre>
+     *
      * @return a new ApiServerConfig
      * @throws IllegalStateException if enableAuth is true but apiKey is not set
      * @throws IllegalStateException if maxThreadPoolSize is less than threadPoolSize
+     * @throws IllegalStateException if enableTls is true but keystorePath or keystorePassword is
+     *     not set, or if keystorePath/keystorePassword is empty/whitespace
+     * @throws IllegalStateException if enableTls is true but no TLS protocols are configured
+     * @throws IllegalStateException if weak TLS protocols (TLSv1.0, TLSv1.1) are enabled
      */
     public ApiServerConfig build() {
       if (enableAuth && (apiKey == null || apiKey.trim().isEmpty())) {
@@ -331,6 +494,34 @@ public ApiServerConfig build() {
         }
       }
 
+      // Validate TLS configuration
+      if (enableTls) {
+        if (keystorePath == null || keystorePath.trim().isEmpty()) {
+          throw new IllegalStateException(
+              "SECURITY: Keystore path is REQUIRED when TLS is enabled. "
+                  + "Set via: ApiServerConfig.builder().keystorePath(\"/path/to/keystore.jks\")");
+        }
+        if (keystorePassword == null || keystorePassword.trim().isEmpty()) {
+          throw new IllegalStateException(
+              "SECURITY: Keystore password is REQUIRED when TLS is enabled. "
+                  + "Set via: ApiServerConfig.builder().keystorePassword(...) "
+                  + "or environment variable");
+        }
+        if (enabledProtocols == null || enabledProtocols.length == 0) {
+          throw new IllegalStateException("SECURITY: At least one TLS protocol must be enabled");
+        }
+        // Validate no weak protocols are enabled
+        for (String protocol : enabledProtocols) {
+          if (protocol.matches(".*TLSv1(\\.0)?$") || protocol.matches(".*TLSv1\\.1$")) {
+            throw new IllegalStateException(
+                "SECURITY: Weak TLS protocol detected: "
+                    + protocol
+                    + ". Only TLSv1.2+ are allowed. "
+                    + "Use: ApiServerConfig.builder().enabledProtocols(\"TLSv1.2\", \"TLSv1.3\")");
+          }
+        }
+      }
+
       if (maxThreadPoolSize < threadPoolSize) {
         throw new IllegalStateException(
             "Max thread pool size ("