---
title: "Provide TLS certificates for Calico Enterprise Manager"
description: "Add TLS certificates to secure access to Calico Enterprise Manager user interface."
product: "Calico Enterprise"
version: "3.21"
section: "Operations"
canonical_url: "https://docs.tigera.io/calico-enterprise/3.21/operations/comms/manager-tls"
---

# Provide TLS certificates for Calico Enterprise Manager

## Big picture

Provide TLS certificates that secure access to the Calico Enterprise web console user interface.

## Value

By default, the Calico Enterprise web console uses self-signed TLS certificates on connections. This article describes how to provide TLS certificates that users' browsers will trust.

## Before you begin...

- **Get the certificate and key pair for the Calico Enterprise web console** Generate the certificate using any X.509-compatible tool or from your organization's Certificate Authority. The certificate must have Common Name or Subject Alternate Names that match the IPs or DNS names that will be used to [access the web console](https://docs.tigera.io/calico-enterprise/3.21/operations/cnx/access-the-manager.md).

## How to

To provide certificates for use during deployment you must create a secret before applying the 'custom-resource.yaml' or before creating the Installation resource. To specify certificates for use in the manager, create a secret using the following command:

```bash
kubectl create secret generic manager-tls -n tigera-operator --from-file=tls.crt=</path/to/certificate-file> --from-file=tls.key=</path/to/key-file>
```

To update existing certificates, run the following command:

```bash
kubectl create secret generic manager-tls -n tigera-operator --from-file=tls.crt=</path/to/certificate-file> --from-file=tls.key=</path/to/key-file> --dry-run -o yaml --save-config | kubectl replace -f -
```

If the Calico Enterprise web console is already running then updating the secret should cause it to restart and pickup the new certificate and key. This will result in a short period of unavailability of the Calico Enterprise web console.

## Additional resources

Additional documentation is available for securing [the Calico Enterprise web console connections](https://docs.tigera.io/calico-enterprise/3.21/operations/comms/crypto-auth.md).