> For the complete documentation index, see [llms.txt](https://docs.carto.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.carto.com/carto-self-hosted/configuration/networking/tls-offloading.md).
# TLS Offloading
TLS offloading (or TLS termination) means SSL/TLS is terminated at your external Load Balancer or Ingress Controller, and traffic is then forwarded internally to the CARTO Router over HTTP. This is the **recommended** SSL/TLS strategy for standard production deployments.
{% hint style="info" %}
**Key benefit:** The entire certificate lifecycle is managed automatically at the load balancer or ingress level, eliminating the operational burden of certificate rotation.
{% endhint %}
## When to use TLS offloading
* Standard production deployments.
* You want automated certificate provisioning and renewal, with no manual intervention.
* You integrate with a WAF or DDoS protection at the edge.
* You want simplified operations with no certificate expiration concerns.
For stricter requirements (compliance mandating encryption throughout the infrastructure, zero-trust architectures, or client certificate authentication), use [End-to-End TLS](/carto-self-hosted/configuration/networking/end-to-end-tls.md) instead.
{% hint style="info" %}
Certificates and private keys **must not be encrypted or protected with a passphrase**. CARTO Self-Hosted does not support encrypted certificates.
{% endhint %}
## Configuration
{% tabs %}
{% tab title="☸️ Kots (Admin Console)" %} 
The configuration path depends on your deployment type and access mode.
### Standard Orchestrated — Default Access mode (GKE / EKS)
In **Default Access mode**, Kots automatically deploys a cloud-managed load balancer and handles TLS for you. No explicit TLS Termination field is shown: TLS offloading is built in.
| Cloud | What Kots deploys | TLS mechanism |
| ------- | -------------------------------------------------- | ----------------------------------------------------------------- |
| **GKE** | GKE L7 Global External Load Balancer (Gateway API) | Google-managed certificate (enter the cert name in Admin Console) |
| **EKS** | AWS Network Load Balancer with ALB annotations | ACM certificate (enter the ACM cert ARN in Admin Console) |
| **AKS** | ❌ Not supported | AKS requires Custom access mode |
### Standard Orchestrated — Custom Access mode (all K8s distros, including AKS)
In **Custom Access mode** you bring your own load balancer or ingress controller. Configure TLS offloading in Admin Console → Config → **Access to CARTO**:
1. Set **Self-Hosted access mode** → **Custom**
2. Set **TLS Termination** → **"Terminate TLS in a higher layer and connect to CARTO over HTTP"**
3. Click **Save config** → **Deploy**
CARTO will accept plain HTTP from your LB on port 80. Point your load balancer or ingress controller to the CARTO Router service on port 80.
### Single Virtual Machine (Embedded Cluster)
1. In Admin Console → Config → **Access to CARTO**, locate **TLS Termination**
2. Select **"Terminate TLS in a higher layer and connect to CARTO over HTTP"**
3. Click **Save config** → **Deploy**
Place a reverse proxy (nginx, Caddy, etc.) or cloud load balancer in front of the Single VM to handle TLS, forwarding HTTP traffic to the VM on port 80.
For load balancer architecture recommendations, see [Load balancing best practices](/carto-self-hosted/best-practices/deployment/load-balancing-best-practices.md).
{% endtab %}
{% tab title="🛞 Helm (customizations.yaml)" %} 
No explicit TLS configuration is needed within the CARTO Helm chart: the external component handles all SSL aspects. The CARTO Router is exposed as a `ClusterIP` service on HTTP port 80, and your Ingress Controller or Cloud Load Balancer performs TLS termination and forwards to it.
| Pattern | Notes |
| ----------------------------------- | ------------------------------------------------------------------------------------------ |
| **ClusterIP + Ingress Controller** | Ingress Controller (nginx, Traefik, etc.) terminates TLS and forwards to ClusterIP port 80 |
| **ClusterIP + Cloud Load Balancer** | Cloud LB (GKE, ALB, Azure Gateway) terminates TLS and forwards to ClusterIP |
Add to your `customizations.yaml`:
```yaml
# Disable HTTPS inside CARTO — TLS is handled by the external load balancer
tlsCerts:
httpsEnabled: false
autoGenerate: false
router:
service:
type: ClusterIP
ports:
http: 80
```
For load balancer architecture and cloud provider examples, see [Load balancing best practices](/carto-self-hosted/best-practices/deployment/load-balancing-best-practices.md).
{% endtab %}
{% endtabs %}
## Related
* [Load balancing best practices](/carto-self-hosted/best-practices/deployment/load-balancing-best-practices.md) — full publishing architectures and cloud provider recommendations
* [End-to-End TLS](/carto-self-hosted/configuration/networking/end-to-end-tls.md) — terminate TLS at the CARTO Router instead
* [Custom Domains & TLS](/carto-self-hosted/configuration/networking/custom-domains-and-tls.md)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.carto.com/carto-self-hosted/configuration/networking/tls-offloading.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.