Skip to content

Configure private TLS

For a customer-owned private domain, the customer certificate authority must issue the certificate. The supported workflow uses the deployment-generated private key and certificate signing request (CSR).

Private certificate lifecycle showing the managed certificate action retaining the private key, CSR download, customer certificate authority signing, public-chain upload, endpoint activation, and hostname verification.

The private key remains in the managed platform. The customer exchanges only the CSR and signed public certificate chain.

Before you begin

You need:

  • working Private Endpoint connectivity;
  • working private DNS;
  • the exact private service hostnames;
  • access to the certificate or CSR action exposed by the managed application;
  • a certificate authority trusted by every client.

Issue and upload the certificate

  1. In the managed application view, open the approved private-certificate action.
  2. Download the private-scope CSR.
  3. Inspect the CSR and confirm that its subject alternative names cover every private service hostname supplied by the deployment.
  4. Submit the CSR to the approved certificate authority.
  5. Obtain the issued leaf certificate and required intermediate certificates in the format accepted by the upload action.
  6. Upload the public certificate chain through the private-certificate action.
  7. Wait until the action reports completion and the endpoint serves the new certificate.

Do not upload or send a private key. The deployment retains the private key used to create the CSR and validates that the returned certificate matches it.

Verify TLS

From an approved client, set the exact deployment-provided hostname:

SERVICE_HOSTNAME="<deployment-service-hostname>"

openssl s_client \
  -connect "${SERVICE_HOSTNAME}:443" \
  -servername "${SERVICE_HOSTNAME}" \
  -verify_return_error </dev/null

Confirm:

  • the command ends with Verify return code: 0 (ok);
  • the certificate is within its validity period;
  • the hostname appears in the subject alternative names;
  • the chain ends at a CA trusted by the client;
  • no private key or secret appears in command output saved for support.

Name or service not known indicates DNS failure. Connection timed out or Connection refused indicates a network or endpoint failure. unable to get local issuer certificate indicates an incomplete or untrusted chain. certificate verify failed requires inspection of the detailed verification error; do not disable verification.

Repeat the check for each service hostname. Then sign in securely.