For the complete documentation index, see llms.txt. This page is also available as Markdown.

Custom Domains & TLS

Configure custom domains and TLS certificates for CARTO Self-Hosted

Overview

CARTO Self-Hosted must be accessed over HTTPS. This page covers how to configure a custom domain and attach a TLS certificate to your deployment.

Domain requirements

  • The domain must be a dedicated subdomain or apex domain (e.g., carto.yourcompany.com). Subdirectory paths (e.g., yourcompany.com/carto) are not supported.

  • The domain must match the domain registered in your CARTO license.

  • Create a DNS A record (or CNAME if using a cloud load balancer with a DNS name) pointing to your load balancer IP or VM public IP.

TLS certificate options

Choose one of the following approaches based on your environment:

Option 1: cert-manager with Let's Encrypt (Kubernetes only)

cert-manager automates the issuance and renewal of free TLS certificates from Let's Encrypt. This is the recommended approach for Kubernetes deployments with outbound internet access.

Install cert-manager and configure a ClusterIssuer for Let's Encrypt following the official cert-manager documentation. Once set up, CARTO's Helm chart can be configured to use the issuer automatically via customizations.yaml.

Option 2: Cloud-managed certificate

Use a TLS certificate managed by your cloud provider's certificate service. This avoids managing cert rotation yourself.

Use Google-managed SSL certificates with GKE Ingress. Configure the networking.gke.io/managed-certificates annotation on your ingress with a ManagedCertificate resource pointing to your domain.

Option 3: Bring your own certificate (BYOC)

If you have an existing certificate from a commercial CA or an internal PKI, configure it in your load balancer or ingress controller following your company's standard process. Ensure you have a renewal process in place before the certificate expires.

Checklist

Last updated

Was this helpful?