> For the complete documentation index, see [llms.txt](https://docs.carto.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.carto.com/carto-self-hosted/configuration/networking/custom-domains-and-tls.md).

# Custom Domains & TLS

## Overview

CARTO Self-Hosted must be accessed over HTTPS. This page covers how to configure a custom domain and attach a TLS certificate to your deployment.

## Domain requirements

* The domain must be a **dedicated subdomain or apex domain** (e.g., `carto.yourcompany.com`). Subdirectory paths (e.g., `yourcompany.com/carto`) are not supported.
* The domain must match the domain registered in your CARTO license.
* Create a DNS **A record** (or CNAME if using a cloud load balancer with a DNS name) pointing to your load balancer IP or VM public IP.

## TLS certificate options

Choose one of the following approaches based on your environment:

### Option 1: cert-manager with Let's Encrypt (Kubernetes only)

cert-manager automates the issuance and renewal of free TLS certificates from Let's Encrypt. This is the recommended approach for Kubernetes deployments with outbound internet access.

Install cert-manager and configure a ClusterIssuer for Let's Encrypt following the [official cert-manager documentation](https://cert-manager.io/docs/). Once set up, CARTO's Helm chart can be configured to use the issuer automatically via `customizations.yaml`.

### Option 2: Cloud-managed certificate

Use a TLS certificate managed by your cloud provider's certificate service. This avoids managing cert rotation yourself.

{% tabs %}
{% tab title="GCP" %}
Use **Google-managed SSL certificates** with GKE Ingress. Configure the `networking.gke.io/managed-certificates` annotation on your ingress with a `ManagedCertificate` resource pointing to your domain.
{% endtab %}

{% tab title="AWS" %}
Use **AWS Certificate Manager (ACM)** with an ALB. Set the `alb.ingress.kubernetes.io/certificate-arn` annotation on your ingress to the ARN of your ACM certificate.
{% endtab %}

{% tab title="Azure" %}
Use **Azure App Gateway** with a certificate from Azure Key Vault, or configure TLS termination directly on the Application Gateway.
{% endtab %}
{% endtabs %}

### Option 3: Bring your own certificate (BYOC)

If you have an existing certificate from a commercial CA or an internal PKI, configure it in your load balancer or ingress controller following your company's standard process. Ensure you have a renewal process in place before the certificate expires.

{% hint style="warning" %}
Self-signed certificates will cause browser warnings and are only appropriate for internal testing. Use a CA-signed certificate for any production or user-facing deployment.
{% endhint %}

## Checklist

* [ ] DNS A/CNAME record is created and propagated to your load balancer or VM IP
* [ ] Domain matches the domain in your CARTO license
* [ ] TLS certificate is obtained (Let's Encrypt, cloud-managed, or BYOC)
* [ ] Certificate is configured in your deployment


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.carto.com/carto-self-hosted/configuration/networking/custom-domains-and-tls.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.