# Securing internal communication This page explains how TLS secures communication between units of the same application or between applications within a single model. ## Architecture ## How it works - **`self-signed-certificates`** is deployed in the same model as the applications. - Each application integrates with it over the `tls-certificates` interface in **UNIT mode**, so every unit receives its own unique leaf certificate. - Each unit also receives the **CA certificate** that signed it. Units trust this CA to validate each other’s certificates. - The certificate chain is: `[Leaf Certificate, CA Certificate]`. ## When to use - Internal traffic between units of a replicated application (e.g., database peer replication). - Inter-application traffic within the same model where both sides can trust the same CA. ## Related topics - [Securing API communication](securing-api-communication.md#securing-api-communication): for client-facing traffic that requires a publicly trusted CA or an ingress. - [CA trust best practices](ca-trust-best-practices.md#ca-trust-best-practices): how trust is established and why internal certs require a private CA. - [Multi-model TLS reference architectures](../deployment-blueprints/multi-model-tls.md#multi-model-tls): when the deployment spans multiple Juju models.