Yes, when using Kong Konnect with an OIDC (OpenID Connect) client, SSL (TLS) is typically required in production environments for both security and functional reasons. Here’s a breakdown of why:

---

✅ Why SSL/TLS is Required for OIDC with Kong Konnect

1. OIDC Specification Requires HTTPS

• The OIDC standard mandates that communication between clients and identity providers (IdPs) must use HTTPS to protect tokens and credentials.
• For example, the redirect_uri used in the OIDC flow must be HTTPS, or most IdPs will reject it.

2. Kong Konnect’s OIDC Plugin Requires HTTPS for Secure Redirects

• If you’re using the Kong OIDC plugin, especially in Authorization Code Flow, Kong must redirect users to the IdP and then receive the callback securely.
• Without SSL, the redirect URI may be considered invalid or insecure by the IdP.