> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/operator-installation/prerequisites/dns-and-tls-certificates.md).

# DNS and TLS certificates

### DNS configuration <a href="#dns-configuration" id="dns-configuration"></a>

The Harness Installer requires an externally resolvable DNS hostname that points to your load balancer or ingress controller.

#### Requirements <a href="#requirements" id="requirements"></a>

Your DNS hostname must meet both of the following conditions.

* DNS must be **externally resolvable** from client browsers
* Points to a **load balancer** configured for TLS pass-through (port 443)

#### Set the DNS <a href="#set-the-dns" id="set-the-dns"></a>

Set the DNS hostname with whichever method you use to install.

{% tabs %}
{% tab title="helm" %}

```yaml
cluster:
  tfi:
    dns: platform.example.com
```

{% endtab %}

{% tab title="clustermgr" %}

```bash
--dns platform.example.com 
```

{% endtab %}
{% endtabs %}

### TLS certificates <a href="#tls-certificates" id="tls-certificates"></a>

You either let the operator generate a self-signed certificate or supply your own.

#### Auto-generated self-signed certificates (default) <a href="#auto-generated-self-signed-certificates-default" id="auto-generated-self-signed-certificates-default"></a>

By default, the operator generates a self-signed TLS certificate with the following characteristics.

* Stored as a Kubernetes Secret named after the DNS hostname (e.g., `platform.example.com`)
* Used for TLS termination at the ingress controller

#### Bring your own certificates <a href="#bring-your-own-certificates" id="bring-your-own-certificates"></a>

To use your own TLS certificate, provide the certificate and private key:

{% tabs %}
{% tab title="helm" %}

```bash
  --set-file cluster.tfi.private_key=/path/to/tls_private_key.pem 
  --set-file cluster.tfi.tls_cert=/path/to/tls_cert.crt 
  --set-file cluster.tfi.root_ca_cert=/path/to/root_ca.crt 
```

{% endtab %}

{% tab title="clustermgr" %}

```bash
  --pi-set-file cluster.tfi.private_key="</path/to/tls_private_key.pem>" 
  --pi-set-file cluster.tfi.tls_cert="</path/to/tls_cert.crt>" 
  --pi-set-file cluster.tfi.root_ca_cert="</path/to/root_ca.crt>"
```

{% endtab %}
{% endtabs %}

#### Istio TLS considerations <a href="#istio-tls-considerations" id="istio-tls-considerations"></a>

If you use Istio ingress, the TLS secret must be in the **same namespace as the Istio ingress gateway pod**.

**Scenario 1: Harness SMP Operator installs Istio**

When the operator deploys Istio, it manages the TLS secret automatically.

* The TLS secret is created in the operator namespace (e.g., `harness`)
* The Istio ingress gateway pod also runs in the operator namespace

The operator creates a TLS secret named `platform.example.com` in the `harness` namespace.

For more information, see [Install with Istio - Scenario 1](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/operator-installation/install/install-with-smp-operator.md#scenario-1-fresh-istio-install).

**Scenario 2: You have existing Istio**

If you use an existing Istio deployment, the operator does **not** manage the TLS secret. Ensure the following:

* A TLS secret exists in the namespace where the Istio ingress gateway pod runs
* The TLS secret name must match the DNS value only when the operator creates the Istio Gateway (see [Install with Istio - Scenario 2](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/operator-installation/install/install-with-smp-operator.md#scenario-2-existing-istio-no-gatewayvirtualservice))
* In [Install with Istio - Scenario 3](/self-managed-enterprise-edition/use-self-managed-enterprise-edition/smp-installationupgrade/operator-installation/install/install-with-smp-operator.md#scenario-3-existing-istio--gateway), the operator creates only the VirtualService, so TLS secret naming is handled by your existing Gateway configuration