---
title: Charmhub | Deploy TLS Certificates Interface using Charmhub - The Open Operator
  Collection
description: Deploy the latest version of TLS Certificates Interface as a Kubernetes
  Operator on any cloud.
url: https://charmhub.io/tls-certificates-interface/docs/h-ca-trust-best-practices
---

# TLS Certificates Interface

[Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco")

* [Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco")

Platform:

edge 277

```
juju deploy tls-certificates-interface --channel edge
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

---

#### Relevant links

* [Homepage](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

# Trust CA certificates of TLS Providers

In the Juju ecosystem, multiple TLS providers can be used to issue certificates for applications and units.

* [self-signed-certificates](https://charmhub.io/self-signed-certificates)
* [vault](https://charmhub.io/vault-k8s)
* [lego](https://charmhub.io/lego)
* [manual-tls-certificates](https://charmhub.io/manual-tls-certificates)

In some cases, the CA certificates used by these providers are self-signed. This means that the certificates they issue will not be trusted by default by other applications or clients unless the CA is explicitly trusted.

### [Best Practices for Production Deployments](https://charmhub.io/tls-certificates-interface/docs/h-ca-trust-best-practices#p-38567-best-practices-for-production-deployments)

* **Internal Communication (Unit-to-Unit)**
  As described in the [internal communication guide](https://charmhub.io/tls-certificates-interface/docs/h-securing-internal-communication), `self-signed-certificates` can be used to secure intra-application traffic.
  In this case:
  + Each unit of an application receives the CA certificate as part of the relation data from the [tls-certificates](https://charmhub.io/tls-certificates-interface) integration.
  + The CA is the direct issuer of the application’s leaf certificate.
  + Trusting this CA is sufficient to establish trust in the leaf certificates.
* **API Communication**
  For more complex deployments that [secure API communication](https://charmhub.io/tls-certificates-interface/docs/h-securing-api-communication), client applications should trust the CA directly from the CA provider, not from the application.
  + The CA certificate can be obtained by integrating with the provider over the [certificates-transfer](https://charmhub.io/certificate-transfer-interface) interface.
  + When the provider uses intermediate CA, it is recommended to trust the provider with the root CA (or the highest CA in the hierarchy). However this is not mandatory.

---