@@ -92,6 +92,12 @@ faqs:
       signs each proxied request using static IAM credentials, environment auto-detection, or an assumed role. This
       is separate from [`access.auth_strategies`](#schema-aigateway-agent-access), which authenticates inbound
       clients rather than outbound requests to the upstream agent. See [Upstream authentication](#upstream-authentication).
+
+  - q: How do I connect to an upstream agent that requires mTLS or serves a certificate from a private CA?
+    a: |
+      Set [`config.certificates`](#schema-aigateway-agent-config-certificates) for mTLS, or [`config.ca_certificates`](#schema-aigateway-agent-config-ca-certificates) for a private CA.
+      Both fields apply to `a2a` and `http` AI Agents and require {{site.ai_gateway}} 2.3 or later.
+      See [Upstream TLS](#upstream-tls).
 ---
 
 ## What is an AI Agent?
@@ -377,6 +383,23 @@ config:
 
 `config.upstream` is available regardless of the AI Agent's [`type`](#schema-aigateway-agent-type); it applies to `a2a` and `http` Agents alike.
 
+## Upstream TLS {% new_in 2.3 %}
+
+{% include md/ai-gateway/v2/upstream-tls.md name='AI Agent' schema_prefix='schema-aigateway-agent-config' %}
+
+These fields apply to both `a2a` and `http` AI Agents.
+
+In the following example, the AI Agent presents the `agent-client-cert` certificate to the upstream and verifies the upstream against the `kongair-internal-root-ca` CA:
+
+```yaml
+config:
+  url: https://booking-agent.internal.kongair.com
+  certificates:
+    - agent-client-cert
+  ca_certificates:
+    - kongair-internal-root-ca
+```
+
 ## Attach AI Policies
 
 To enforce security, transformation, or governance controls on agent traffic (for example, request validation, PII detection, request logging), attach [AI Policies](/ai-gateway/entities/ai-policy/) to the agent. Add policy names or IDs to the AI Agent's [`policies`](#schema-aigateway-agent-policies) field. Multiple AI Policies can attach to one AI Agent; each runs independently in the request lifecycle.
 
@@ -29,6 +29,10 @@ related_resources:
     url: /ai-gateway/entities/ai-sni/
   - text: AI Data Plane Certificate
     url: /ai-gateway/entities/ai-data-plane-certificate/
+  - text: AI MCP Server entity
+    url: /ai-gateway/entities/ai-mcp-server/
+  - text: AI Agent entity
+    url: /ai-gateway/entities/ai-agent/
 faqs:
   - q: How is an AI CA Certificate different from a {{site.base_gateway}} CA Certificate?
     a: |
@@ -39,6 +43,13 @@ faqs:
       authority, carries no private key, and is used to verify the certificate a client or an
       upstream server presents. An AI Certificate is an identity the data plane uses itself: it carries a private key and is
       presented to complete a TLS handshake.
+  - q: Can AI MCP Servers and AI Agents use an AI CA Certificate to verify their upstreams?
+    a: |
+      Yes.
+      Yes, in {{site.ai_gateway}} 2.3 and later.
+      Reference one or more AI CA Certificates by name in the `config.ca_certificates` field of an [AI MCP Server](/ai-gateway/entities/ai-mcp-server/#upstream-tls) or [AI Agent](/ai-gateway/entities/ai-agent/#upstream-tls).
+      The AI MCP Server or AI Agent then uses them to verify the upstream's certificate, which lets it connect to upstreams signed by a private or internal CA.
+      If you don't set the field, the default trust store is used.
 ---
 
 ## What is an AI CA Certificate
 
@@ -31,6 +31,10 @@ related_resources:
     url: /ai-gateway/entities/ai-vault/
   - text: AI Data Plane Certificate entity
     url: /ai-gateway/entities/ai-data-plane-certificate/
+  - text: AI MCP Server entity
+    url: /ai-gateway/entities/ai-mcp-server/
+  - text: AI Agent entity
+    url: /ai-gateway/entities/ai-agent/
 faqs:
   - q: How is an AI Certificate different from a {{site.base_gateway}} Certificate?
     a: |
@@ -62,6 +66,14 @@ faqs:
       No. The `key` and `key_alt` fields are write-only. They're accepted on create and update, but
       never returned by a read. Keep your own copy of any key you register, or store it in an
       [AI Vault](/ai-gateway/entities/ai-vault/) and register a reference to it instead of the literal value.
+
+  - q: Can AI MCP Servers and AI Agents present an AI Certificate to their upstreams?
+    a: |
+      Yes.
+      Yes, in {{site.ai_gateway}} 2.3 and later.
+      Reference the AI Certificate by name in the `config.certificates` field of an [AI MCP Server](/ai-gateway/entities/ai-mcp-server/#upstream-tls) or [AI Agent](/ai-gateway/entities/ai-agent/#upstream-tls).
+      The AI MCP Server or AI Agent then presents it as its client certificate, which lets it connect to upstreams that require mutual TLS (mTLS).
+      The AI Certificate must include a private key.
 ---
 
 ## What is an AI Certificate?
 
@@ -105,6 +105,12 @@ faqs:
       clients, and from [`config.server.tools_list_auth`](#schema-aigateway-mcpserver-config-server-tools-list-auth),
       which only authenticates the one-time fetch of an `upstream-server`'s tool list. See
       [Upstream authentication](#upstream-authentication).
+
+  - q: How do I connect to an upstream that requires mTLS or serves a certificate from a private CA?
+    a: |
+      Set [`config.certificates`](#schema-aigateway-mcpserver-config-certificates) for mTLS, or [`config.ca_certificates`](#schema-aigateway-mcpserver-config-ca-certificates) for a private CA.
+      Both fields require {{site.ai_gateway}} 2.3 or later.
+      See [Upstream TLS](#upstream-tls).
 ---
 
 ## What is an AI MCP Server?
@@ -525,6 +531,24 @@ config:
       role_session_name: kong-ai-gateway
 ```
 
+## Upstream TLS {% new_in 2.3 %}
+
+{% include md/ai-gateway/v2/upstream-tls.md name='AI MCP Server' schema_prefix='schema-aigateway-mcpserver-config' %}
+
+These fields work in every [server mode](#server-modes) that connects to an upstream: `conversion-only`, `conversion-listener`, `passthrough-listener`, and `upstream-server`.
+They have no effect in `listener` mode, because a listener only aggregates tools from other AI MCP Servers and doesn't connect to an upstream itself.
+
+In the following example, the AI MCP Server presents the `mcp-client-cert` certificate to the upstream and verifies the upstream against the `kongair-internal-root-ca` CA:
+
+```yaml
+config:
+  url: https://mcp.internal.kongair.com
+  certificates:
+    - mcp-client-cert
+  ca_certificates:
+    - kongair-internal-root-ca
+```
+
 ## ACL tool control
 
 When exposing MCP servers through {{site.ai_gateway}}, you may need granular control over which authenticated [AI Consumers](/ai-gateway/entities/ai-consumer/) can discover and invoke specific tools. The MCP Server's ACL feature lets you define access rules at both the default level (which applies to all tools) and per-tool level (for fine-grained exceptions).
 
@@ -0,0 +1,32 @@
+When {{include.name}} connects to an upstream (the server at [`config.url`](#{{include.schema_prefix}}-url)), it does so over TLS by default, without presenting a client certificate, and trusts only the certificate authorities (CAs) in the data plane's default trust store.
+Use the following fields in `config` when your upstream needs something different:
+
+<!-- vale off -->
+{% table %}
+columns:
+  - title: Use case
+    key: use_case
+  - title: Field
+    key: field
+  - title: What to reference
+    key: reference
+rows:
+  - use_case: |
+      The upstream requires mutual TLS (mTLS), so {{include.name}} must prove its identity to the upstream.
+    field: "[`config.certificates`](#{{include.schema_prefix}}-certificates)"
+    reference: |
+      One [AI Certificate](/ai-gateway/entities/ai-certificate/). It must include a private key.
+      The field is an array, but accepts only one entry.
+  - use_case: |
+      The upstream serves a certificate signed by a private or internal CA that the data plane doesn't trust by default.
+    field: "[`config.ca_certificates`](#{{include.schema_prefix}}-ca-certificates)"
+    reference: |
+      One or more [AI CA Certificates](/ai-gateway/entities/ai-ca-certificate/). Together, they replace the default trust store when {{include.name}} verifies the upstream.
+{% endtable %}
+<!-- vale on -->
+
+You can use either field on its own, or both together.
+
+To reference a certificate, create the AI Certificate or AI CA Certificate first, then enter its `name` in the field.
+The `name` of a certificate can't be changed after you create it, so the reference stays valid.
+If a referenced name doesn't exist, the API returns an `HTTP 400` error.