# Multi-model TLS reference architecture This reference architecture shows how to secure a multi-model Juju deployment with TLS. It combines a central PKI model for public-facing certificates with per-model `self-signed-certificates` for internal communication. ## Architecture ## How it works **Internal communication**: Each model deploys `self-signed-certificates` which issues per-unit certificates in UNIT mode. Units use these to encrypt peer traffic (replication, cluster membership). **Public-facing communication**: A central PKI model hosts a TLS provider (Vault, Lego, or any other) that issues certificates in APP mode: - **Application A** is behind an ingress. The TLS provider issues a certificate to Traefik. The ingress trusts the internal CA via `certificate-transfer` so it can validate Application A’s backend certificate. - **Application B** is accessed directly by clients. The TLS provider issues a certificate directly to Application B in APP mode. The application serves this certificate on its public endpoint. **CA trust**: Applications that need to validate the central CA (e.g., to call another service that presents a certificate issued by it) receive it via `certificate-transfer` from the PKI model. #### NOTE The per-model `self-signed-certificates` for internal communication could also be centralised into the PKI model. This simplifies CA management at the cost of making all models dependent on the PKI model for internal cert renewal.