> For the complete documentation index, see [llms.txt](https://docs.carto.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.carto.com/carto-self-hosted/configuration/networking/end-to-end-tls.md).

# End-to-End TLS

With End-to-End TLS, SSL/TLS remains encrypted all the way to the CARTO Router, which is responsible for terminating it. Use this instead of [TLS Offloading](/carto-self-hosted/configuration/networking/tls-offloading.md) when your requirements demand encryption throughout the infrastructure.

{% hint style="warning" %}
**You are fully responsible for the certificate lifecycle** — acquisition, renewal, and rotation. Unlike TLS offloading, there is no automatic certificate management.
{% endhint %}

## When to use

* Strict compliance requirements mandating encryption throughout the infrastructure.
* Zero-trust architectures that require absolute end-to-end encryption.
* Requirement for client certificate authentication.

For standard production deployments without these requirements, [TLS Offloading](/carto-self-hosted/configuration/networking/tls-offloading.md) is recommended instead.

## Kots

Configure your domain's SSL certificate in the **Admin Console** when setting up access to CARTO. Provide the `.crt` (full chain) and `.key` files for your domain.

{% hint style="info" %}
Certificates and private keys **must not be encrypted or protected with a passphrase**. Generate a passphrase-free key with `openssl rsa -in key_with_passphrase.key -out key.key`.
{% endhint %}

## Helm

### 1. Certificate preparation

Obtain a valid SSL/TLS certificate from a Certificate Authority (CA). You need:

* A valid SSL certificate for your CARTO domain
* The full certificate chain (server certificate + intermediate CA certificates)
* The private key corresponding to the certificate
* PEM-encoded format for both certificate and key

### 2. Encode certificates to Base64

The Helm chart requires certificates to be base64-encoded **without line breaks**:

```bash
# 1. Encode the full certificate chain (including intermediates)
cat /path/to/fullchain.pem | base64 | tr -d '\n' > cert.b64

# 2. Encode the private key
cat /path/to/privkey.pem | base64 | tr -d '\n' > key.b64
```

{% hint style="info" %}
The `tr -d '\n'` removes all line breaks, producing a single-line base64 string. On macOS you can also use `base64 -i /path/to/file`. Keep these values secure, as they contain your private key.
{% endhint %}

### 3. customizations.yaml

Enable TLS and reference your certificate and key:

```yaml
# Enable HTTPS and disable cert autogeneration.
tlsCerts:
  httpsEnabled: true
  autoGenerate: false

router:
  service:
    type: ClusterIP
    ports:
      https: 443
      httpsTargetPort: "https"

  ## Add the base64 cert keys to the router.
  tlsCertificates:
    certificateValueBase64: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZaRENDQk..."
    privateKeyValueBase64: "LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQU..."
```

## Related

* [TLS Offloading](/carto-self-hosted/configuration/networking/tls-offloading.md) — terminate TLS at the load balancer instead (recommended for standard deployments)
* [Load balancing best practices](/carto-self-hosted/best-practices/deployment/load-balancing-best-practices.md) — full SSL/TLS decision guide and publishing architectures
* [Custom Domains & TLS](/carto-self-hosted/configuration/networking/custom-domains-and-tls.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.carto.com/carto-self-hosted/configuration/networking/end-to-end-tls.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.