Support per-server custom CA certificates for HTTP MCP upstreams #15065

Feature request

Support an author-configured custom CA certificate for an individual HTTP MCP upstream. Apply that CA only to the gateway's outbound TLS connections to the configured server, without modifying process-wide or runner-wide trust.

Motivation

HTTP MCP servers using a private or self-signed CA cannot be used without additional trust configuration. Current workarounds, such as changing the runner's trust store or introducing a bridge that drops TLS on a hop, are broader or weaker than necessary.

A per-server setting would let a reviewed workflow trust one named upstream without giving the agent a new runtime capability. This is analogous to per-server OIDC authentication: another author-configured connection property of the same upstream.

Requested behavior

• Expose custom CA configuration on an individual HTTP MCP server entry in the gateway configuration.
• Use the configured CA only for that server's outbound TLS connections; do not change trust for other upstreams or global trust stores.
• Keep TLS certificate and hostname verification enabled; this must not be an insecure-skip-verification option.
• Preserve existing TLS behavior for servers without custom CA configuration.
• Report invalid or unreadable certificate configuration clearly, without logging certificate contents or credentials.
• Document the configuration format and add coverage for private-CA connections, trust isolation between servers, invalid CA configuration, and unchanged default behavior.

The exact configuration field and certificate input format can be defined by the gateway implementation so gh-aw can compile to a supported interface.

Downstream dependency

This is needed for github/gh-aw#68033. The implementation attempt in github/gh-aw#69436 identified that the pinned gateway lacks per-server CA configuration. Once the gateway supports it, gh-aw can expose the setting through workflow schema, compilation, tests, and documentation.

Related per-server OIDC support: github/gh-aw-mcpg#2878.