TLS Offloading
Configure TLS offloading for CARTO Self-Hosted
TLS offloading (or TLS termination) means SSL/TLS is terminated at your external Load Balancer or Ingress Controller, and traffic is then forwarded internally to the CARTO Router over HTTP. This is the recommended SSL/TLS strategy for standard production deployments.
Key benefit: The entire certificate lifecycle is managed automatically at the load balancer or ingress level, eliminating the operational burden of certificate rotation.
When to use TLS offloading
Standard production deployments.
You want automated certificate provisioning and renewal, with no manual intervention.
You integrate with a WAF or DDoS protection at the edge.
You want simplified operations with no certificate expiration concerns.
For stricter requirements (compliance mandating encryption throughout the infrastructure, zero-trust architectures, or client certificate authentication), use End-to-End TLS instead.
Certificates and private keys must not be encrypted or protected with a passphrase. CARTO Self-Hosted does not support encrypted certificates.
Configuration
The configuration path depends on your deployment type and access mode.
Standard Orchestrated — Default Access mode (GKE / EKS)
In Default Access mode, Kots automatically deploys a cloud-managed load balancer and handles TLS for you. No explicit TLS Termination field is shown: TLS offloading is built in.
GKE
GKE L7 Global External Load Balancer (Gateway API)
Google-managed certificate (enter the cert name in Admin Console)
EKS
AWS Network Load Balancer with ALB annotations
ACM certificate (enter the ACM cert ARN in Admin Console)
AKS
❌ Not supported
AKS requires Custom access mode
Standard Orchestrated — Custom Access mode (all K8s distros, including AKS)
In Custom Access mode you bring your own load balancer or ingress controller. Configure TLS offloading in Admin Console → Config → Access to CARTO:
Set Self-Hosted access mode → Custom
Set TLS Termination → "Terminate TLS in a higher layer and connect to CARTO over HTTP"
Click Save config → Deploy
CARTO will accept plain HTTP from your LB on port 80. Point your load balancer or ingress controller to the CARTO Router service on port 80.
Single Virtual Machine (Embedded Cluster)
In Admin Console → Config → Access to CARTO, locate TLS Termination
Select "Terminate TLS in a higher layer and connect to CARTO over HTTP"
Click Save config → Deploy
Place a reverse proxy (nginx, Caddy, etc.) or cloud load balancer in front of the Single VM to handle TLS, forwarding HTTP traffic to the VM on port 80.
For load balancer architecture recommendations, see Load balancing best practices.
No explicit TLS configuration is needed within the CARTO Helm chart: the external component handles all SSL aspects. The CARTO Router is exposed as a ClusterIP service on HTTP port 80, and your Ingress Controller or Cloud Load Balancer performs TLS termination and forwards to it.
ClusterIP + Ingress Controller
Ingress Controller (nginx, Traefik, etc.) terminates TLS and forwards to ClusterIP port 80
ClusterIP + Cloud Load Balancer
Cloud LB (GKE, ALB, Azure Gateway) terminates TLS and forwards to ClusterIP
Add to your customizations.yaml:
For load balancer architecture and cloud provider examples, see Load balancing best practices.
Related
Load balancing best practices — full publishing architectures and cloud provider recommendations
End-to-End TLS — terminate TLS at the CARTO Router instead
Last updated
Was this helpful?