# Explanation

* [Understanding TLS in Juju deployments](understanding-tls.md)
  * [Where to terminate TLS](understanding-tls.md#where-to-terminate-tls)
  * [Choosing a TLS provider](understanding-tls.md#choosing-a-tls-provider)
  * [Why API and internal certificates often require separate CAs](understanding-tls.md#why-api-and-internal-certificates-often-require-separate-cas)
* [Securing internal communication](explanation/securing-internal-communication.md)
  * [Architecture](explanation/securing-internal-communication.md#architecture)
  * [How it works](explanation/securing-internal-communication.md#how-it-works)
  * [When to use](explanation/securing-internal-communication.md#when-to-use)
  * [Related topics](explanation/securing-internal-communication.md#related-topics)
* [Securing API communication](explanation/securing-api-communication.md)
  * [With an ingress](explanation/securing-api-communication.md#with-an-ingress)
  * [Without an ingress](explanation/securing-api-communication.md#without-an-ingress)
  * [When to use](explanation/securing-api-communication.md#when-to-use)
  * [Related topics](explanation/securing-api-communication.md#related-topics)
* [CA trust best practices](explanation/ca-trust-best-practices.md)
  * [Trust establishment between clients and applications](explanation/ca-trust-best-practices.md#trust-establishment-between-clients-and-applications)
  * [Best practices for production deployments](explanation/ca-trust-best-practices.md#best-practices-for-production-deployments)