End-to-End TLS

Terminate TLS at the CARTO Router for end-to-end encryption

With End-to-End TLS, SSL/TLS remains encrypted all the way to the CARTO Router, which is responsible for terminating it. Use this instead of TLS Offloading when your requirements demand encryption throughout the infrastructure.

You are fully responsible for the certificate lifecycle — acquisition, renewal, and rotation. Unlike TLS offloading, there is no automatic certificate management.

When to use

• Strict compliance requirements mandating encryption throughout the infrastructure.

• Zero-trust architectures that require absolute end-to-end encryption.

• Requirement for client certificate authentication.

For standard production deployments without these requirements, TLS Offloading is recommended instead.

Kots

Configure your domain's SSL certificate in the Admin Console when setting up access to CARTO. Provide the .crt (full chain) and .key files for your domain.

Certificates and private keys must not be encrypted or protected with a passphrase. Generate a passphrase-free key with openssl rsa -in key_with_passphrase.key -out key.key.

Helm

1. Certificate preparation

Obtain a valid SSL/TLS certificate from a Certificate Authority (CA). You need:

• A valid SSL certificate for your CARTO domain

• The full certificate chain (server certificate + intermediate CA certificates)

• The private key corresponding to the certificate

• PEM-encoded format for both certificate and key

2. Encode certificates to Base64

The Helm chart requires certificates to be base64-encoded without line breaks:

# 1. Encode the full certificate chain (including intermediates)
cat /path/to/fullchain.pem | base64 | tr -d '\n' > cert.b64

# 2. Encode the private key
cat /path/to/privkey.pem | base64 | tr -d '\n' > key.b64

The tr -d '\n' removes all line breaks, producing a single-line base64 string. On macOS you can also use base64 -i /path/to/file. Keep these values secure, as they contain your private key.

3. customizations.yaml

Enable TLS and reference your certificate and key:

# Enable HTTPS and disable cert autogeneration.
tlsCerts:
  httpsEnabled: true
  autoGenerate: false

router:
  service:
    type: ClusterIP
    ports:
      https: 443
      httpsTargetPort: "https"

  ## Add the base64 cert keys to the router.
  tlsCertificates:
    certificateValueBase64: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZaRENDQk..."
    privateKeyValueBase64: "LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQU..."

Related

• TLS Offloading — terminate TLS at the load balancer instead (recommended for standard deployments)

• Load balancing best practices — full SSL/TLS decision guide and publishing architectures

• Custom Domains & TLS