---
title: Charmhub | Deploy TLS Constraints using Charmhub - The Open Operator Collection
description: Deploy the latest version of TLS Constraints on any cloud.
url: https://charmhub.io/tls-constraints/docs/getting-started
---

# TLS Constraints

[Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco")

* [Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco")

Platform:

22.04

stable 51

```
juju deploy tls-constraints
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

---

#### Relevant links

* [Homepage](https://charmhub.io/tls-constraints)

---

#### Contacts

* [Submit a bug](https://github.com/canonical/tls-constraints-operator/issues)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

# Getting Started

In this tutorial, we will use the TLS Constraints, Self Signed Certificates and 2 TLS Requirer charms to demonstrate how to use the constraints charm to block CSR’s from being forwarded to the TLS Provider.

## [1. Install pre-requisites](https://charmhub.io/tls-constraints/docs/getting-started#p-31358-h-1-install-pre-requisites)

Install MicroK8s:

```
sudo snap install microk8s
```

Enable the `hostpath-storage` MicroK8s add-on:

```
microk8s enable hostpath-storage
```

Install Juju:

```
sudo snap install juju
```

## [2. Bootstrap a Juju controller](https://charmhub.io/tls-constraints/docs/getting-started#p-31358-h-2-bootstrap-a-juju-controller)

Bootstrap a Juju controller:

```
juju bootstrap microk8s
```

Create a Juju model:

```
juju add-model demo
```

## [3. Deploy Self Signed Certificates](https://charmhub.io/tls-constraints/docs/getting-started#p-31358-h-3-deploy-self-signed-certificates)

```
juju deploy self-signed-certificates
```

## [4. Deploy tls-certificates-requirers](https://charmhub.io/tls-constraints/docs/getting-started#p-31358-h-4-deploy-tls-certificates-requirers)

```
juju deploy ch:tls-certificates-requirer tls-requirer1
juju deploy ch:tls-certificates-requirer tls-requirer2
```

## [5. Deploy TLS Constraints](https://charmhub.io/tls-constraints/docs/getting-started#p-31358-h-5-deploy-tls-constraints)

```
juju deploy tls-constraints --channel beta
```

## [6. Relate the Upstream Certificate Provider](https://charmhub.io/tls-constraints/docs/getting-started#p-31358-h-6-relate-the-upstream-certificate-provider)

```
juju integrate tls-constraints:certificates-upstream self-signed-certificates
```

## [7. Configure TLS Constraints](https://charmhub.io/tls-constraints/docs/getting-started#p-31358-h-7-configure-tls-constraints)

```
juju config tls-constraints limit-to-one-request=True
```

Feel free to inspect all of the config options to see what’s available

## [8. Relate the Downstream Certificate Requirers](https://charmhub.io/tls-constraints/docs/getting-started#p-31358-h-8-relate-the-downstream-certificate-requirers)

```
juju integrate tls-constraints:certificates-downstream tls-requirer1
juju integrate tls-constraints:certificates-downstream tls-requirer2
```

You should see the second requirer be filtered out

```
juju status

Model  Controller          Cloud/Region        Version  SLA          Timestamp
demo    microk8s-localhost  microk8s/localhost  3.4.2    unsupported  14:31:22Z

App                       Version  Status  Scale  Charm                      Channel        Rev  Address         Exposed  Mess
age
self-signed-certificates           active      1  self-signed-certificates   latest/stable   72  10.152.183.172  no
tls-constraints                    active      1  tls-constraints            latest/beta     47  10.152.183.134  no
tls-requirer1                      active      1  tls-certificates-requirer  latest/stable   72  10.152.183.159  no       Cert
ificate is available
tls-requirer2                      active      1  tls-certificates-requirer  latest/stable   72  10.152.183.68   no       Cert
ificate request is sent

Unit                         Workload  Agent  Address       Ports  Message
self-signed-certificates/0*  active    idle   10.1.252.83
tls-constraints/0*           active    idle   10.1.252.127
tls-requirer1/0*             active    idle   10.1.252.89          Certificate is available
tls-requirer2/0*             active    idle   10.1.252.98          Certificate request is sent

Integration provider                     Requirer                               Interface         Type     Message
self-signed-certificates:certificates    tls-constraints:certificates-upstream  tls-certificates  regular
tls-constraints:certificates-downstream  tls-requirer1:certificates             tls-certificates  regular
tls-constraints:certificates-downstream  tls-requirer2:certificates             tls-certificates  regular
```

---