Secure 6.0: Configure TLS certificates for Liquibase Secure server

Task
Create

Configure TLS certificates for Liquibase Secure server

Last updated: September 29, 2026

By default, liquibase-platform install generates a self-signed TLS certificate, and browsers show a security warning when your team opens the web app. Use this guide to serve the deployment with a certificate issued by your organization's certificate authority instead.

Procedure

Obtain a PEM-encoded certificate and private key

Request a certificate for the hostname your team will use to reach the server. Common sources are:

Active Directory Certificate Services (Windows PKI)
HashiCorp Vault PKI secrets engine
An internal OpenSSL certificate authority
Certbot with Let's Encrypt, which requires public DNS and internet access

Both files must be PEM-encoded. If your certificate authority provides a certificate chain, concatenate the leaf and intermediate certificates into a single file.

Install the certificates

New installation: Pass both certificate flags to the install command. The flags must be provided together, and the files are copied into the deployment's certs/ directory.

Be sure to:

Replace your_registry_url with the container registry URL provided by Liquibase. For example, registry.liquibase.com
Replace path/to/server.crt and path/to/server.key with the paths to your certificate and private key files

./liquibase-platform install --registry your_registry_url \
  --tls-cert path/to/server.crt \
  --tls-key path/to/server.key

Running deployment: Copy the new certificate and key over the existing files in the certs/ directory, then restart the stack.

cp path/to/new.crt certs/server.crt
cp path/to/new.key certs/server.key
./liquibase-platform stop && ./liquibase-platform start

Verify the certificate

Open the web app URL in a browser and confirm that no certificate warning appears. To inspect the certificate the server presents, run:

Be sure to:

Replace your_server_host with the hostname of your deployment. For example, liquibase.internal.example.com

openssl s_client -connect your_server_host:443 -servername your_server_host < /dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Troubleshooting

TLS certificate generation fails during install

If the install command cannot generate a self-signed certificate, place your own certificate and key at certs/server.crt and certs/server.key, then run the install again.

PreviousHosting options for an internal deployment NextRun Liquibase Secure server behind a reverse proxy