Use Your Own TLS Certificate

This page explains how to have a hostname served with a TLS certificate you supply — for example an EV or OV certificate a partner requires — instead of the certificate the platform issues automatically, and what to prepare so it works first time.

Most hostnames do not need this: the platform issues and renews a certificate for every hostname automatically. See Ingress, Custom Domains and TLS.

Before you start

• The certificate file, in PEM format, with your certificate first and then the intermediate certificates from your certificate authority. The root certificate is not needed.
• The private key, in PEM format, unencrypted (no passphrase), with plain line endings. A key saved on Windows often has Windows line endings, which the platform rejects with failed to find any PEM data; convert the file to Unix line endings first.
• A 1Password item your environment can read, holding the certificate and the key in two separate fields. Never send the private key in Slack, a ticket or e-mail. How the platform reads 1Password is explained in Inject Secrets from 1Password.

Request it

Raise a request with:

• the hostname, and the Environment and Component that serve it;
• the 1Password item and the names of the certificate and key fields;
• the certificate's expiry date.

CTO2B connects the certificate to the hostname and switches off automatic issuance for it, so the two do not overwrite each other.

Verify it worked

Check which certificate the hostname now serves:

openssl s_client -connect myapp.example.com:443 -servername myapp.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -enddate

The subject and issuer should be your certificate's. If the output shows default-certificate or the automatic issuer, the certificate is not being served yet — reply on your request with the output.

Renewing it

A certificate you supply is not renewed automatically — you own its renewal. Before it expires:

1. Get the renewed certificate from your certificate authority.
2. Replace the certificate and key in the same 1Password item, in the same format.
3. The platform picks up the new values within a few minutes. Run the check above to confirm the new expiry date.

Put the expiry date in your own calendar: when a supplied certificate expires, browsers show a certificate warning on that hostname.

Related articles

• Ingress, Custom Domains and TLS — the automatic certificates most hostnames use
• Inject Secrets from 1Password — how the platform reads 1Password items
• Ingress Troubleshooting — certificate warnings and other ingress problems