diff --git a/changelog.md b/changelog.md
index decafee..9f456f6 100644
--- a/changelog.md
+++ b/changelog.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 2026-02-26 - 4.3.0 - feat(hub)
+add optional TLS certificate/key support to hub start config and bridge
+
+- TypeScript: add tls.certPem and tls.keyPem to IHubConfig and include tlsCertPem/tlsKeyPem in startHub bridge command when both are provided
+- TypeScript: extend startHub params with tlsCertPem and tlsKeyPem and conditionally send them
+- Rust: change HubConfig serde attributes for tls_cert_pem and tls_key_pem from skip to default so absent PEM fields deserialize as None
+- Enables optional provisioning of TLS certificate and key to the hub when provided from the JS side
+
 ## 2026-02-26 - 4.2.0 - feat(core)
 expose edge peer address in hub events and migrate writers to channel-based, non-blocking framing with stream limits and timeouts
 
diff --git a/rust/crates/remoteingress-core/src/hub.rs b/rust/crates/remoteingress-core/src/hub.rs
index 64367fd..cdbba5b 100644
--- a/rust/crates/remoteingress-core/src/hub.rs
+++ b/rust/crates/remoteingress-core/src/hub.rs
@@ -15,9 +15,9 @@ use remoteingress_protocol::*;
 pub struct HubConfig {
     pub tunnel_port: u16,
     pub target_host: Option<String>,
-    #[serde(skip)]
+    #[serde(default)]
     pub tls_cert_pem: Option<String>,
-    #[serde(skip)]
+    #[serde(default)]
     pub tls_key_pem: Option<String>,
 }
 
diff --git a/ts/00_commitinfo_data.ts b/ts/00_commitinfo_data.ts
index 9b9bd34..62e6f58 100644
--- a/ts/00_commitinfo_data.ts
+++ b/ts/00_commitinfo_data.ts
@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/remoteingress',
-  version: '4.2.0',
+  version: '4.3.0',
   description: 'Edge ingress tunnel for DcRouter - accepts incoming TCP connections at network edge and tunnels them to DcRouter SmartProxy preserving client IP via PROXY protocol v1.'
 }
diff --git a/ts/classes.remoteingresshub.ts b/ts/classes.remoteingresshub.ts
index 23e5963..b1486f8 100644
--- a/ts/classes.remoteingresshub.ts
+++ b/ts/classes.remoteingresshub.ts
@@ -11,6 +11,8 @@ type THubCommands = {
     params: {
       tunnelPort: number;
       targetHost?: string;
+      tlsCertPem?: string;
+      tlsKeyPem?: string;
     };
     result: { started: boolean };
   };
@@ -42,6 +44,10 @@ type THubCommands = {
 export interface IHubConfig {
   tunnelPort?: number;
   targetHost?: string;
+  tls?: {
+    certPem?: string;
+    keyPem?: string;
+  };
 }
 
 export class RemoteIngressHub extends EventEmitter {
@@ -100,6 +106,9 @@ export class RemoteIngressHub extends EventEmitter {
     await this.bridge.sendCommand('startHub', {
       tunnelPort: config.tunnelPort ?? 8443,
       targetHost: config.targetHost ?? '127.0.0.1',
+      ...(config.tls?.certPem && config.tls?.keyPem
+        ? { tlsCertPem: config.tls.certPem, tlsKeyPem: config.tls.keyPem }
+        : {}),
     });
 
     this.started = true;