Kong: certificates and SNIs handle TLS termination

curl -X POST http://localhost:8001/certificates \
  --form cert=@fullchain.pem \
  --form key=@privkey.pem \
  --form 'snis[]=api.example.com' \
  --form 'snis[]=api2.example.com'

# force HTTPS on a route
curl -X PATCH http://localhost:8001/routes/api \
  --data 'protocols[]=https' \
  --data https_redirect_status_code=301

curl -I http://localhost:8000/api
  HTTP/1.1 301 Moved Permanently
  Location: https://api.example.com/api

# With protocols=[http, https] the route answers both and never redirects.
# Listing https alone is what makes the redirect happen.
#
# TLS to the UPSTREAM is separate: set the service url to https:// and, for
# mutual TLS, attach a client_certificate to the service.