# Securing API communication This page explains how TLS secures client-facing traffic, where external clients or other services connect to your applications over HTTPS directly or through an ingress. ## With an ingress When clients reach the application through an ingress (e.g., Traefik), TLS is terminated at the ingress with a publicly trusted certificate. The ingress then connects to the backend over a separate internal TLS channel. - **API TLS provider** (Lego, Vault, or another provider) issues a certificate for the ingress in **APP mode**. This is the publicly trusted certificate presented to clients. - **Traefik** terminates client TLS and forwards requests to the backend application. - **`self-signed-certificates`** issues internal certificates to backend applications in **UNIT mode** for end-to-end encryption between the ingress and the application. - The ingress integrates with `self-signed-certificates` over the `certificate-transfer` interface to trust the internal CA, so it can validate the backend application’s certificate. ## Without an ingress When clients connect directly to the application, the application itself serves the API certificate. The application integrates with two TLS providers on two separate relations—one for client-facing certificates and one for internal communication. - **API TLS provider** issues a certificate to the application in **APP mode**. The application presents this certificate to clients on its external-facing endpoint. - **`self-signed-certificates`** issues a separate certificate in **UNIT mode** for internal peer communication (e.g., replication between units). - The application binds each certificate to the appropriate network interface or port—API cert on the external address, internal cert on the cluster/peer address. ## When to use - Any deployment where external clients require HTTPS access to the application—with or without an ingress. - When the API-facing certificate must be publicly trusted (e.g., issued by Let’s Encrypt via Lego). - When end-to-end encryption is needed between the ingress and backend applications—not just TLS termination at the edge. - When the application is directly exposed and needs to serve a trusted certificate while still using a private CA for internal peer traffic. ## Related topics - [Securing internal communication](securing-internal-communication.md#securing-internal-communication): for unit-to-unit TLS without an ingress. - [Understanding TLS](../understanding-tls.md#understanding-tls): why API and internal certs require separate CAs. - [Multi-model TLS reference architectures](../deployment-blueprints/multi-model-tls.md#multi-model-tls): when the TLS provider or the ingress is in a different model.