Custom Domains & TLS
Configure custom domains and TLS certificates for CARTO Self-Hosted
Last updated
Was this helpful?
Configure custom domains and TLS certificates for CARTO Self-Hosted
CARTO Self-Hosted must be accessed over HTTPS. This page covers how to configure a custom domain and attach a TLS certificate to your deployment.
The domain must be a dedicated subdomain or apex domain (e.g., carto.yourcompany.com). Subdirectory paths (e.g., yourcompany.com/carto) are not supported.
The domain must match the domain registered in your CARTO license.
Create a DNS A record (or CNAME if using a cloud load balancer with a DNS name) pointing to your load balancer IP or VM public IP.
Choose one of the following approaches based on your environment:
cert-manager automates the issuance and renewal of free TLS certificates from Let's Encrypt. This is the recommended approach for Kubernetes deployments with outbound internet access.
Install cert-manager and configure a ClusterIssuer for Let's Encrypt following the official cert-manager documentation. Once set up, CARTO's Helm chart can be configured to use the issuer automatically via customizations.yaml.
Use a TLS certificate managed by your cloud provider's certificate service. This avoids managing cert rotation yourself.
Use Google-managed SSL certificates with GKE Ingress. Configure the networking.gke.io/managed-certificates annotation on your ingress with a ManagedCertificate resource pointing to your domain.
Use AWS Certificate Manager (ACM) with an ALB. Set the alb.ingress.kubernetes.io/certificate-arn annotation on your ingress to the ARN of your ACM certificate.
Use Azure App Gateway with a certificate from Azure Key Vault, or configure TLS termination directly on the Application Gateway.
If you have an existing certificate from a commercial CA or an internal PKI, configure it in your load balancer or ingress controller following your company's standard process. Ensure you have a renewal process in place before the certificate expires.
Self-signed certificates will cause browser warnings and are only appropriate for internal testing. Use a CA-signed certificate for any production or user-facing deployment.
Last updated
Was this helpful?
Was this helpful?