---
title: Charmhub | Deploy TLS Certificates Interface using Charmhub - The Open Operator
  Collection
description: Deploy the latest version of TLS Certificates Interface as a Kubernetes
  Operator on any cloud.
url: https://charmhub.io/tls-certificates-interface/docs/h-security
---

# TLS Certificates Interface

[Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco")

* [Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco")

Platform:

edge 277

```
juju deploy tls-certificates-interface --channel edge
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

---

#### Relevant links

* [Homepage](https://charmhub.io/tls-certificates-interface/libraries/tls_certificates)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

# Security

The TLS Certificates Interface and library are developed with Security as one of their core values. This document outlines the key security features of the interface and library.

If you discover a security issue, see the [TLS Certificates Interface security policy](https://github.com/canonical/tls-certificates-interface/blob/main/SECURITY.md) for information on how to report the issue.

## [Private Key management](https://charmhub.io/tls-certificates-interface/docs/h-security#p-38341-private-key-management)

In X.509 certificate workflows, the private key is highly sensitive and must remain confidential. As outlined in [TLS Certificates Interface Explanation](https://charmhub.io/tls-certificates-interface/docs/h-tls-certificates-interface), the private key never leaves the charm that requires the TLS certificate.

### [Encryption at Rest](https://charmhub.io/tls-certificates-interface/docs/h-security#p-38341-encryption-at-rest)

The TLS Certificates library stores the private key in a Juju secret that can only be read by the charm requiring the TLS certificates or a Juju administrator.

For information on how you can manage Juju secret backends, see [How to manage secret backends](https://documentation.ubuntu.com/juju/3.6/howto/manage-secret-backends/#manage-secret-backends).

### [Key Generation Algorithm](https://charmhub.io/tls-certificates-interface/docs/h-security#p-38341-key-generation-algorithm)

The TLS Certificates library generates private keys using the [RSA algorithm](https://en.wikipedia.org/wiki/RSA_(cryptosystem)).

### [Key rotation](https://charmhub.io/tls-certificates-interface/docs/h-security#p-38341-key-rotation)

Charm authors can rotate the private key by calling the `regenerate_private_key` method which will generate a new private key, remove old certificate requests, and send new ones to the TLS provider.

---