--- schema_version: "1" id: 9f434b950e3580003c96771ade3afa5db1aef980efb65e9c833d5fdfc81c780a title: Configuring Internal Custom Certificates for Tableau Server collection: tableau version: current locale: en-us portal_url: https://docs.salesforce.com/tableau/current/en-us/server/internal-certs-server.md canonical_url: https://help.tableau.com/current/server/en-us/internal-certs-server.htm source_site: help.tableau.com content_type: documentation content_hash: 8c721331661154c102d67e9a9f316a4edeeae550e316bfaf3f7c103d097d0a89 description: Configure forward proxies, reverse proxies, and load balancers for Tableau Server. --- [Skip to main content](#main-content) # Configuring Internal Custom Certificates for Tableau Server **Version:** Added in version 2026.3.0. By default Tableau Server uses self-signed certificates to encrypt communications between internal services and components. Beginning in version 2026.3.0, server administrators have the option to replace those TSM-generated certificates with custom certificates issued by their own enterprise PKI or certificate authority (CA). This topic explains how to configure Tableau Server to use custom certificates for its internal service-to-service communications instead of the default, self-signed certificates. (Some certificates are service-specific and some are for components that use multiple services. For the sake of simplicity, we use the term "services" here to include both cases.) **Note:** The custom certificates and tsm commands to configure Tableau Server discussed here are specific to internal communication between Tableau Server services. These certificates are distinct from external (gateway) SSL, which faces browsers and other external clients. For information on configuring external SSL, see [Configure SSL for External HTTP Traffic to and from Tableau Server](https://help.tableau.com/current/server/en-us/ssl_config.htm). We recommend that you use a separate certificate for external gateway SSL. ## Why use custom certificates? Not every installation of Tableau Server needs custom certificates, but for enterprises that need to follow regulated-industry compliance requirements (FIPS for example) the ability to use custom certificates in place of the self-signed certificates is crucial. These may also be necessary to resolve security scans that flag self-signed internal certificates. Your IT and security teams should tell you if you need to use custom certificates. ## Services supporting custom certificates The following internal services support custom certificates. Use the service name with the `--name` option of `tsm security internal-cert set` and `tsm security internal-cert reset`. To see the available service names, run `tsm security internal-cert list` without the `--name` option. - Simple TLS (server certificate and key, with an optional chain): `apiGateway`, `gatewayInternal`, `hyper`, `jmx`, `thrift`, `tsigLogs`, `relationshipService`, `recommendationsService`, `vizportalMetadataApi`, and `backgrounderMetadataApi` - Mutual TLS (mTLS), which requires a client certificate and key in addition to the server certificate: `activemqMTLS`, `coordinationService` **Note:** The Coordination Service can also be configured with its own command if you choose to use a separate certificate for that. For more information, see [(Optional) Configuring a separate custom certificate for the Coordination Service](#internal-cert-zk) below. In addition, `tsm security internal-cert set-all` orchestrates the following pre-existing subsystems: - Repository SSL (PostgreSQL), TSM Controller SSL, and OpenSearch (Index and Search Server). When you use `set-all`, the server certificate is mapped to the node and service certificates, the client certificate is mapped to the ActiveMQ client and OpenSearch admin, and the chain is mapped to the OpenSearch CA. ## Certificate requirements The certificates and keys that you supply to these commands must meet the following requirements: - Certificates must be PEM-encoded X.509 certificates. Private keys must be in PKCS#1 or PKCS#8 format. - Key algorithms RSA and ECC (EC/ECDSA) are supported. DSA keys are rejected. - Encrypted keys are supported. Use the `--passphrase` and `--client-passphrase` options to supply the passphrase. - Supplying a chain file is optional, but most deployments require one. For a private or internal CA, the root CA must be included in the chain. The root CA can be omitted only if the certificate was issued by a well-known public CA that is already trusted by the JVM. The root CA should also be installed in the operating system and Java truststore on all nodes. - Hostname verification: The TSM Controller certificate must include the controller node's fully qualified domain name (FQDN) as the common name (CN) or as a DNS Subject Alternative Name (SAN)—for example, `DNS:`. This alone satisfies validation. Other internal certificates do not validate hostnames at this time. To keep the certificate valid if the TSM Controller ever moves to a different node, issue the certificate with SANs that cover every node in the cluster that could run the controller, or use a wildcard SAN for the shared domain (for example, `DNS:*.corp.example.com`). - Extended Key Usage (EKU): Do not set the EKU to `serverAuth` or `clientAuth` alone. You can either leave the EKU unset or set it to both values, but not to one individually. ## Configure Tableau Server with custom certificates for internal communication The Tableau Server custom certificates feature introduces a number of new TSM CLI commands. These provide administrators with the ability to designate certificates that Tableau Server should use for communication between internal services. The new commands include a series of sub-commands under `tsm security internal-cert`, and a similar series of sub-commands under `tsm security coordination-service-internal-cert` that are specific to the Coordination Service. ### Configuring custom certificates for individual services A server admin can set a custom certificate for individual services. To configure custom certificates by individual service: - Use `[tsm security internal-cert list](https://help.tableau.com/current/server/en-us/cli_security_tsm.htm#internal-cert-list)` to view the configured internal certificates. - Use `[tsm security internal-cert reset](https://help.tableau.com/current/server/en-us/cli_security_tsm.htm#internal-cert-reset)` to reset an internal certificate for a specified service back to the default, self-signed certificate. - Use `[tsm security internal-cert set](https://help.tableau.com/current/server/en-us/cli_security_tsm.htm#internal-cert-set)` to configure an internal certificate for a specified service. - Use `[tsm security coordination-service-internal-cert set](https://help.tableau.com/current/server/en-us/cli_security_tsm.htm#coordination-service-internal-cert-set)` to configure an internal certificate for the coordination service. ### Configuring custom certificates in bulk A server admin can also set custom certificates in bulk, for all applicable services. To configure custom certificates in bulk (all applicable services): - Use `[tsm security internal-cert list](https://help.tableau.com/current/server/en-us/cli_security_tsm.htm#internal-cert-list)` to view the configured internal certificates. - Use `[tsm security internal-cert reset-all](https://help.tableau.com/current/server/en-us/cli_security_tsm.htm#internal-cert-reset-all)` to reset the internal certificates for all applicable services back to the default, self-signed certificate. - Use `[tsm security internal-cert set-all](https://help.tableau.com/current/server/en-us/cli_security_tsm.htm#internal-cert-set-all)` to configure an internal certificate for all applicable services. Note: To exclude specific services while using the `set-all` or `reset-all` commands, use the `--exclude ` option. ### (Optional) Configuring a separate custom certificate for the Coordination Service The Coordination Service (ZooKeeper) certificate can be configured separately using the `tsm security coordination-service-internal-cert` commands and has specific requirements and limitations. You might want to configure the Coordination Service separately for security reasons, or to limit impact if something goes wrong and you need to reset a certificate. - Use `[tsm security coordination-service-internal-cert list](https://help.tableau.com/current/server/en-us/cli_security_tsm.htm#coordination-service-internal-cert-list)` to view the configured internal certificate for the Coordination Service. - Use `[tsm security coordination-service-internal-cert reset](https://help.tableau.com/current/server/en-us/cli_security_tsm.htm#coordination-service-internal-cert-reset)` to reset an internal certificate for the Coordination Service back to the default, self-signed certificate. - Use `[tsm security coordination-service-internal-cert set](https://help.tableau.com/current/server/en-us/cli_security_tsm.htm#coordination-service-internal-cert-set)` to configure a custom certificate for the Coordination Service. If there are problems with the Coordination Service certificate you need to take specific steps to avoid a full reinstall with backup of Tableau Server. For more information, see [Recovering a Coordination Service Custom Certificate](https://help.tableau.com/current/server/en-us/internal-certs-recovery-zk.htm). ## Related topics ## Other articles in this section