> ## Documentation Index
> Fetch the complete documentation index at: https://ngrok.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Terminate TLS Action

> Control how TLS traffic is terminated by ngrok, including custom certificates and mutual TLS.

export const ConfigEnumOption = ({children}) => {
  return <div className="space-y-2 px-4 py-2 list-none">{children}</div>;
};

export const ConfigEnum = ({label, children}) => {
  return <div className="m-0 flex flex-shrink-0 list-none flex-col divide-y divide-gray-200 self-start rounded-md border border-gray-200 p-0 dark:divide-gray-800 dark:border-gray-800 [&_li+li]:mt-0 [&_li]:py-2 list-none">
      <div className="px-4 py-2 font-semibold list-none">
        {label ? label : "Possible enum values"}
      </div>
      {children}
    </div>;
};

export const ConfigField = ({title, type, cel = false, defaultValue = false, required = false, children}) => {
  const id = `config-${title.replace(/\.|\s|\*/g, "_")}`;
  return <div className="field pt-2.5 pb-5 my-2.5 border-gray-50 dark:border-gray-800/50 border-b" style={{
    scrollMarginTop: '120px'
  }} id={id}>
      <div className="flex font-mono group/param-head param-head break-all relative">
        <div className="flex-1 flex content-start py-0.5 mr-5">
          <div className="flex items-center flex-wrap gap-2">
            <div class="absolute -top-1.5">
              <a href={`#${id}`} className="-ml-10 flex items-center opacity-0 border-0 group-hover/param-head:opacity-100 py-2 [.expandable-content_&]:-ml-[2.1rem]" aria-label="Navigate to header">
                ​<div className="w-6 h-6 rounded-md flex items-center justify-center shadow-sm text-gray-400 dark:text-white/50 dark:bg-background-dark dark:brightness-[1.35] dark:ring-1 dark:hover::rightness-150 bg-white ring-1 ring-gray-400/30 dark:ring-gray-700/25 hover:ring-gray-400/60 dark:hover:ring-white/20">
                  <svg xmlns="http://www.w3.org/2000/svg" fill="gray" height="12px" viewBox="0 0 576 512"><path d="M0 256C0 167.6 71.6 96 160 96h72c13.3 0 24 10.7 24 24s-10.7 24-24 24H160C98.1 144 48 194.1 48 256s50.1 112 112 112h72c13.3 0 24 10.7 24 24s-10.7 24-24 24H160C71.6 416 0 344.4 0 256zm576 0c0 88.4-71.6 160-160 160H344c-13.3 0-24-10.7-24-24s10.7-24 24-24h72c61.9 0 112-50.1 112-112s-50.1-112-112-112H344c-13.3 0-24-10.7-24-24s10.7-24 24-24h72c88.4 0 160 71.6 160 160zM184 232H392c13.3 0 24 10.7 24 24s-10.7 24-24 24H184c-13.3 0-24-10.7-24-24s10.7-24 24-24z"></path></svg>
                </div>
              </a>
            </div>
            <div className="font-semibold text-primary dark:text-primary-light overflow-wrap-anywhere">{title}</div>
            <div className="inline items-center gap-2 text-xs font-medium [&_div]:inline [&_div]:mr-2 [&_div]:leading-5 [&_a]:inline [&_a]:mr-2 [&_a]:leading-5">
              {type && <div className="flex items-center px-2 py-0.5 rounded-md bg-gray-100/50 dark:bg-white/5 break-all">
                <span className="text-gray-600 dark:text-gray-200 !font-medium">{type}</span>
              </div>}
              {defaultValue && <div className="flex items-center px-2 py-0.5 rounded-md bg-gray-100/50 dark:bg-white/5 break-all">
                  <span class="text-gray-400 dark:text-gray-500">default:</span>
                  <span className="text-gray-600 dark:text-gray-200 !font-medium">{defaultValue}</span>
                </div>}
              {required && <div className="px-2 py-0.5 rounded-md bg-red-100/50 dark:bg-red-400/10 whitespace-nowrap">
                <span className="text-red-600 dark:text-red-300 !font-medium">Required</span>
              </div>}
              {cel && <a className="px-2 py-0.5 rounded-md !border-none bg-blue-100/50 dark:bg-blue-400/10 whitespace-nowrap" href="/traffic-policy/concepts/cel-interpolation">
                <span className="text-blue-600 dark:text-blue-300 !font-medium">Supports CEL</span>
              </a>}
            </div>
          </div>
        </div>
      </div>
      <div className="mt-4 prose-sm prose-gray dark:prose-invert [&_.prose>p:first-child]:mt-0 [&_.prose>p:last-child]:mb-0">
        {children}
      </div>
    </div>;
};

The **Terminate TLS** Traffic Policy action allows you to control how TLS traffic is terminated by ngrok. This action is useful for when you need to specify a custom certificate, control which TLS versions are supported, or enable mutual TLS authentication.

## Configuration reference

This is the [Traffic Policy](/traffic-policy/) configuration reference for this action.

### Action type

`terminate-tls`

### Configuration fields

<ConfigField title="min_version" type="string" required={false} defaultValue="1.2">
  The minimum TLS version to support. Must be one of `1.2` or `1.3`.
</ConfigField>

<ConfigField title="max_version" type="string" required={false} defaultValue="1.3">
  The maximum TLS version to support. Must be one of `1.2` or `1.3`.
</ConfigField>

<ConfigField title="server_private_key" type="string" required={false} cel={true}>
  The PEM-encoded private key for the server if using a custom certificate (must be specified with `server_certificate`).
</ConfigField>

<ConfigField title="server_certificate" type="string" required={false} cel={true}>
  The PEM-encoded certificate for the server if using a custom certificate (must be specified with `server_private_key`).
</ConfigField>

<ConfigField title="mutual_tls_certificate_authorities" type="array of strings" required={false} cel={true}>
  A list of PEM-encoded Certificate Authority certificates and/or Certificate Authority IDs that are trusted for mutual TLS authentication.
</ConfigField>

<ConfigField title="mutual_tls_verification_strategy" type="string" required={false} defaultValue="require-and-verify">
  The strategy to use for mutual TLS verification.

  <ConfigEnum>
    <ConfigEnumOption value="require-and-verify">Require and verify</ConfigEnumOption>
    <ConfigEnumOption value="require-any">Require any</ConfigEnumOption>
    <ConfigEnumOption value="request">Request</ConfigEnumOption>
  </ConfigEnum>
</ConfigField>

### Supported phases

* `on_tcp_connect`

### Supported schemes

* `https`
* `tls`

## Behavior

For HTTPS endpoints, ngrok will already terminate TLS connections for you even if you do not explicitly use this action in your Traffic Policy. If you specify this action in your Traffic Policy without any configuration, you will see no change in behavior for your endpoints.

For TLS endpoints, ngrok will not terminate the TLS connection by default and it is up to you to handle TLS termination in your upstream service.

### Changing supported TLS versions

You can use this action to specify the minimum and maximum TLS versions that your endpoint will support for incoming connections. By default, your endpoint will support TLS versions 1.2 and 1.3. If you want to support different versions of TLS, you can use the `min_version` and `max_version` fields in the configuration. Clients using an unsupported version of TLS will receive a handshake error.

### Non-terminating action

This is a **Non-terminating action**. It does not return a response, and will allow Traffic Policy processing to continue to the next Action in the chain. All **Cloud Endpoint** Traffic Policies must end with a terminating action. This requirement does not apply to **Agent Endpoints**.

## Examples

### Minimum and maximum TLS versions

This example sets the minimum and maximum TLS versions that the endpoint will support for incoming connections to TLS version 1.3. Clients can then only connect to the endpoint using TLS version 1.3 and will receive a handshake error if they attempt to connect using a different version.

#### Example Traffic Policy document

<CodeGroup>
  ```yaml policy.yml theme={null}
  on_tcp_connect:
    - actions:
        - type: terminate-tls
          config:
            min_version: '1.3'
            max_version: '1.3'
  ```

  ```json policy.json theme={null}
  {
    "on_tcp_connect": [
      {
        "actions": [
          {
            "type": "terminate-tls",
            "config": {
              "min_version": "1.3",
              "max_version": "1.3"
            }
          }
        ]
      }
    ]
  }
  ```
</CodeGroup>

#### Start an endpoint with Traffic Policy

```bash theme={null}
ngrok http 8080 --url https://terminate-tls-example.ngrok.app --traffic-policy-file /path/to/policy.yml
```

#### Make a request

```bash theme={null}
curl https://terminate-tls-example.ngrok.app
```

If your curl was built with a version of OpenSSL that supports TLS 1.3, the request will succeed. However, you can verify that the endpoint only supports TLS 1.3 by telling curl to use a different version of TLS:

```bash theme={null}
curl https://terminate-tls-example.ngrok.app --tlsv1.2 --tls-max 1.2
```

You should receive a "alert protocol version" error indicating that the endpoint only supports TLS 1.3.

### Using a custom certificate

If you want to specify a custom certificate for your endpoints instead of having ngrok manage the certificate for you, you can use the `server_private_key` and `server_certificate` fields in the configuration. This will allow you to have full control over which certificate is used for your endpoint.

#### Generate certificates

Create a new Certificate Authority (CA) that will be used to sign the
server certificate. This allows you to generate multiple server certificates
that are trusted by the CA if needed.

<Note>Note that this generates a self-signed
certificate, so if you would like to use a custom certificate that is trusted
by modern operating systems and browsers you will need to use a trusted CA
(for example, LetsEncrypt).</Note>

<Steps>
  <Step title="Generate CA private key (ca.key)">
    ```bash theme={null}
    openssl genpkey -algorithm RSA -out ca.key -pkeyopt rsa_keygen_bits:2048
    ```
  </Step>

  <Step title="Generate CA certificate (ca.crt)">
    ```bash theme={null}
    openssl req -x509 -new -nodes -key ca.key -sha256 -days 365 -out ca.crt -subj "/CN=ExampleCA"
    ```
  </Step>

  <Step title="Generate server private key (server.key)">
    ```bash theme={null}
    openssl genpkey -algorithm RSA -out server.key -pkeyopt rsa_keygen_bits:2048
    ```
  </Step>

  <Step title="Generate server certificate signing request (CSR) (server.csr)">
    ```bash theme={null}
    openssl req -new -key server.key -out server.csr -subj "/CN=terminate-tls-example.ngrok.app"
    ```

    <Note>Change `terminate-tls-example.ngrok.app` to the domain you are using with your endpoint</Note>
  </Step>

  <Step title="Generate server certificate (server.crt)">
    ```bash theme={null}
    openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 365 -sha256
    ```
  </Step>
</Steps>

These commands will result in five new files: `ca.key`, `ca.crt`, `server.key`,
`server.csr`, and `server.key`.

#### Example Traffic Policy document

<CodeGroup>
  ```yaml policy.yml theme={null}
  on_tcp_connect:
    - actions:
        - type: terminate-tls
          config:
            server_private_key: |-
              -----BEGIN PRIVATE KEY-----
              ... private key ...
              -----END PRIVATE KEY-----
            server_certificate: |-
              -----BEGIN CERTIFICATE-----
              ... certificate ...
              -----END CERTIFICATE-----
  ```

  ```json policy.json theme={null}
  {
    "on_tcp_connect": [
      {
        "actions": [
          {
            "type": "terminate-tls",
            "config": {
              "server_private_key": "-----BEGIN PRIVATE KEY-----\n... private key ...\n-----END PRIVATE KEY-----",
              "server_certificate": "-----BEGIN CERTIFICATE-----\n... certificate ...\n-----END CERTIFICATE-----"
            }
          }
        ]
      }
    ]
  }
  ```
</CodeGroup>

<Note>
  Replace the contents of `server_private_key` with the contents of `server.key` and
  `server_certificate` with `server.crt` respectively in the Traffic Policy to enable your
  custom certificate on your endpoint and `ca.crt` to trust the
  certificate when using `curl`.
</Note>

#### Start an endpoint with Traffic Policy

```bash theme={null}
ngrok http 8080 --url https://terminate-tls-example.ngrok.app --traffic-policy-file /path/to/policy.yml
```

#### Make a request

Now you can make a request to the endpoint with the `--cacert` flag to specify the CA certificate that was generated.

```bash theme={null}
curl --cacert ca.crt https://terminate-tls-example.ngrok.app
```

If you have a service running on port `8080`, your request will be forwarded to that service.
If you don't have any service running on that port, ngrok will return an error page but the certificate setup will have worked.

### Enabling mutual TLS

This example demonstrates how to use mutual TLS (mTLS) with this action. mTLS requires both the client and server to present certificates to each other to establish a secure connection. This example will show you how to generate a custom Certificate Authority (CA) and client certificate to use.

#### Generate certificates

Create a new CA that will be used to sign the client certificate. This allows you to generate multiple client certificates that are trusted by the CA if needed.

```bash theme={null}
# 1. Generate CA private key (ca.key)
openssl genpkey -algorithm RSA -out ca.key -pkeyopt rsa_keygen_bits:2048

# 2. Generate CA certificate (ca.crt)
openssl req -x509 -new -nodes -key ca.key -sha256 -days 365 -out ca.crt -subj "/CN=ExampleCA"

# 3. Generate client private key (client.key)
openssl genpkey -algorithm RSA -out client.key -pkeyopt rsa_keygen_bits:2048

# 4. Generate client certificate signing request (CSR) (client.csr)
openssl req -new -key client.key -out client.csr -subj "/CN=ExampleClient"

# 5. Generate client certificate (client.crt)
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out client.crt -days 365 -sha256
```

These commands will result in five new files: `ca.key`, `ca.crt`, `client.key`, `client.csr`, and `client.key`. You will use the contents of `ca.crt` in your Traffic Policy to validate requests via `curl` which will use `client.key` and `client.crt`.

#### Example Traffic Policy document

Using the CA certificate generated above, you can specify the `mutual_tls_certificate_authorities` field in the Traffic Policy to trust the CA that issued the client certificate.

<CodeGroup>
  ```yaml policy.yml theme={null}
  on_tcp_connect:
    - actions:
        - type: terminate-tls
          config:
            mutual_tls_certificate_authorities:
              - |-
                -----BEGIN CERTIFICATE-----
                ... certificate ...
                -----END CERTIFICATE-----
  ```

  ```json policy.json theme={null}
  {
    "on_tcp_connect": [
      {
        "actions": [
          {
            "type": "terminate-tls",
            "config": {
              "mutual_tls_certificate_authorities": [
                "-----BEGIN CERTIFICATE-----\n... certificate ...\n-----END CERTIFICATE-----"
              ]
            }
          }
        ]
      }
    ]
  }
  ```
</CodeGroup>

You may also optionally [upload the CA certificate](https://dashboard.ngrok.com/tls-cert-authorities) in the ngrok dashboard and use its ID the `mutual_tls_certificate_authorities` array.

#### Start an endpoint with Traffic Policy

```bash theme={null}
ngrok http 8080 --url terminate-tls-example.ngrok.app --traffic-policy-file /path/to/policy.yml
```

#### Make a request

Now you can make a request to the endpoint with the `--cert` and `--key` flags to specify the client certificate and private key.

```bash theme={null}
curl --cert client.crt --key client.key https://terminate-tls-example.ngrok.app
```

## Action result variables

The following variables are made available for use in subsequent expressions and
CEL interpolations after the action has run. Variable values will only apply
to the last action execution, results are not concatenated.

| Name                                                             | Type          | Description                                                                                                         |
| ---------------------------------------------------------------- | ------------- | ------------------------------------------------------------------------------------------------------------------- |
| `actions.ngrok.terminate_tls.cipher_suite`                       | `string`      | The cipher suite selected during the TLS handshake.                                                                 |
| `actions.ngrok.terminate_tls.client.extensions[i].critical`      | `bool`        | True if the extension is critical.                                                                                  |
| `actions.ngrok.terminate_tls.client.extensions[i].id`            | `string`      | The identifier (OID) that specifies the type of extension.                                                          |
| `actions.ngrok.terminate_tls.client.extensions[i].value`         | `[]byte`      | The data for the extension.                                                                                         |
| `actions.ngrok.terminate_tls.client.extensions`                  | `[]Extension` | Additional information added to the certificate.                                                                    |
| `actions.ngrok.terminate_tls.client.issuer.common_name`          | `string`      | Common name of the issuing authority, usually the domain name.                                                      |
| `actions.ngrok.terminate_tls.client.issuer.country`              | `[]string`    | Country names where the issuing authority is located.                                                               |
| `actions.ngrok.terminate_tls.client.issuer.locality`             | `[]string`    | Locality or city of the issuing authority.                                                                          |
| `actions.ngrok.terminate_tls.client.issuer.organization`         | `[]string`    | Name of the organization that issued the certificate.                                                               |
| `actions.ngrok.terminate_tls.client.issuer.organizational_unit`  | `[]string`    | Division of the organization responsible for the certificate.                                                       |
| `actions.ngrok.terminate_tls.client.issuer.postal_code`          | `[]string`    | Postal code of the issuing authority.                                                                               |
| `actions.ngrok.terminate_tls.client.issuer.province`             | `[]string`    | Province or state of the issuing authority.                                                                         |
| `actions.ngrok.terminate_tls.client.issuer.street_address`       | `[]string`    | Street address of the issuing authority.                                                                            |
| `actions.ngrok.terminate_tls.client.issuer`                      | `string`      | The issuing authority of the certificate as a string roughly following the RFC 2253 Distinguished Names syntax.     |
| `actions.ngrok.terminate_tls.client.san.dns_names`               | `[]string`    | DNS names in the subject alternative names.                                                                         |
| `actions.ngrok.terminate_tls.client.san.email_addresses`         | `[]string`    | Email addresses in the subject alternative names.                                                                   |
| `actions.ngrok.terminate_tls.client.san.ip_addresses`            | `[]string`    | IP addresses in the subject alternative names.                                                                      |
| `actions.ngrok.terminate_tls.client.san.uris`                    | `[]string`    | URIs in the subject alternative names.                                                                              |
| `actions.ngrok.terminate_tls.client.san`                         | `string`      | Subject alternative names of the client certificate.                                                                |
| `actions.ngrok.terminate_tls.client.serial_number`               | `string`      | Unique identifier for the certificate.                                                                              |
| `actions.ngrok.terminate_tls.client.signature_algorithm`         | `string`      | Algorithm used to sign the certificate.                                                                             |
| `actions.ngrok.terminate_tls.client.subject.common_name`         | `string`      | Common name of the subject, usually the domain name.                                                                |
| `actions.ngrok.terminate_tls.client.subject.country`             | `[]string`    | Country names where the subject of the certificate is located.                                                      |
| `actions.ngrok.terminate_tls.client.subject.locality`            | `[]string`    | Locality or city where the subject is located.                                                                      |
| `actions.ngrok.terminate_tls.client.subject.organization`        | `[]string`    | Name of the organization to which the subject belongs.                                                              |
| `actions.ngrok.terminate_tls.client.subject.organizational_unit` | `[]string`    | Division of the organization to which the subject belongs.                                                          |
| `actions.ngrok.terminate_tls.client.subject.postal_code`         | `[]string`    | Postal code where the subject is located.                                                                           |
| `actions.ngrok.terminate_tls.client.subject.province`            | `[]string`    | Province or state where the subject is located.                                                                     |
| `actions.ngrok.terminate_tls.client.subject.street_address`      | `[]string`    | Street address where the subject is located.                                                                        |
| `actions.ngrok.terminate_tls.client.subject`                     | `string`      | The entity to whom the certificate is issued as a string roughly following the RFC 2253 Distinguished Names syntax. |
| `actions.ngrok.terminate_tls.client.validity.not_after`          | `timestamp`   | Expiration date and time when the certificate is no longer valid.                                                   |
| `actions.ngrok.terminate_tls.client.validity.not_before`         | `timestamp`   | Start date and time when the certificate becomes valid.                                                             |
| `actions.ngrok.terminate_tls.error.code`                         | `string`      | The error code if the action encountered any errors during its execution.                                           |
| `actions.ngrok.terminate_tls.error.message`                      | `string`      | The error message if the action encountered any errors during its execution.                                        |
| `actions.ngrok.terminate_tls.server.extensions[i].critical`      | `bool`        | True if the extension is critical.                                                                                  |
| `actions.ngrok.terminate_tls.server.extensions[i].id`            | `string`      | The identifier that specifies the type of extension.                                                                |
| `actions.ngrok.terminate_tls.server.extensions[i].value`         | `[]byte`      | The data for the extension.                                                                                         |
| `actions.ngrok.terminate_tls.server.extensions`                  | `[]Extension` | Additional information added to the certificate.                                                                    |
| `actions.ngrok.terminate_tls.server.issuer.common_name`          | `string`      | Common name of the issuing authority, usually the domain name.                                                      |
| `actions.ngrok.terminate_tls.server.issuer.country`              | `[]string`    | Country names where the issuing authority is located.                                                               |
| `actions.ngrok.terminate_tls.server.issuer.locality`             | `[]string`    | Locality or city of the issuing authority.                                                                          |
| `actions.ngrok.terminate_tls.server.issuer.organization`         | `[]string`    | Name of the organization that issued the certificate.                                                               |
| `actions.ngrok.terminate_tls.server.issuer.organizational_unit`  | `[]string`    | Division of the organization responsible for the certificate.                                                       |
| `actions.ngrok.terminate_tls.server.issuer.postal_code`          | `[]string`    | Postal code of the issuing authority.                                                                               |
| `actions.ngrok.terminate_tls.server.issuer.province`             | `[]string`    | Province or state of the issuing authority.                                                                         |
| `actions.ngrok.terminate_tls.server.issuer.street_address`       | `[]string`    | Street address of the issuing authority.                                                                            |
| `actions.ngrok.terminate_tls.server.issuer`                      | `string`      | The issuing authority of the certificate as a string roughly following the RFC 2253 Distinguished Names syntax.     |
| `actions.ngrok.terminate_tls.server.san.dns_names`               | `[]string`    | DNS names in the subject alternative names of the ngrok server's leaf TLS certificate.                              |
| `actions.ngrok.terminate_tls.server.san.email_addresses`         | `[]string`    | Email addresses in the subject alternative names of the ngrok server's leaf TLS certificate.                        |
| `actions.ngrok.terminate_tls.server.san.ip_addresses`            | `[]string`    | IP addresses in the subject alternative names of the ngrok server's leaf TLS certificate.                           |
| `actions.ngrok.terminate_tls.server.san.uris`                    | `[]string`    | URIs in the subject alternative names of the ngrok server's leaf TLS certificate.                                   |
| `actions.ngrok.terminate_tls.server.san`                         | `string`      | Subject alternative names of the ngrok server's leaf TLS certificate.                                               |
| `actions.ngrok.terminate_tls.server.serial_number`               | `string`      | Unique identifier for the certificate.                                                                              |
| `actions.ngrok.terminate_tls.server.signature_algorithm`         | `string`      | Algorithm used to sign the certificate.                                                                             |
| `actions.ngrok.terminate_tls.server.subject.common_name`         | `string`      | Common name of the subject, usually the domain name.                                                                |
| `actions.ngrok.terminate_tls.server.subject.country`             | `[]string`    | Country names where the subject of the certificate is located.                                                      |
| `actions.ngrok.terminate_tls.server.subject.locality`            | `[]string`    | Locality or city where the subject is located.                                                                      |
| `actions.ngrok.terminate_tls.server.subject.organization`        | `[]string`    | Name of the organization to which the subject belongs.                                                              |
| `actions.ngrok.terminate_tls.server.subject.organizational_unit` | `[]string`    | Division of the organization to which the subject belongs.                                                          |
| `actions.ngrok.terminate_tls.server.subject.postal_code`         | `[]string`    | Postal code where the subject is located.                                                                           |
| `actions.ngrok.terminate_tls.server.subject.province`            | `[]string`    | Province or state where the subject is located.                                                                     |
| `actions.ngrok.terminate_tls.server.subject.street_address`      | `[]string`    | Street address where the subject is located.                                                                        |
| `actions.ngrok.terminate_tls.server.subject`                     | `string`      | The entity to whom the certificate is issued as a string roughly following the RFC 2253 Distinguished Names syntax. |
| `actions.ngrok.terminate_tls.server.validity.not_after`          | `timestamp`   | Expiration date and time when the certificate is no longer valid.                                                   |
| `actions.ngrok.terminate_tls.server.validity.not_before`         | `timestamp`   | Start date and time when the certificate becomes valid.                                                             |
| `actions.ngrok.terminate_tls.sni`                                | `string`      | The hostname included in the `ClientHello` message via the SNI extension.                                           |
| `actions.ngrok.terminate_tls.version`                            | `string`      | The version of the TLS protocol used between the client and the ngrok edge.                                         |
| `actions.ngrok.terminate_tls.warnings`                           | `[]string`    | A list of any warnings encountered during the parsing of Certificate Authority IDs.                                 |

<Note>
  These variables are also available on the `conn` object (see [HTTP Variables](/traffic-policy/variables) for examples).
</Note>