> ## Documentation Index
> Fetch the complete documentation index at: https://docs.formal.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Hostname and TLS Configuration

> How to setup hostnames and TLS for your Connectors

The Formal Connector supports encrypted communication using TLS. You can ensure that communications between clients and the Connector are encrypted and ensure that communications between the Connector and Resources are encrypted.

```mermaid theme={null}
sequenceDiagram
    participant Client as Client
    participant Connector as Connector
    participant Resource as Resource

    Note over Client, Connector: TLS Encrypted Connection
    Client->>Connector: Request

    Note over Connector, Resource: TLS Encrypted Connection
    Connector->>Resource: Request
    Resource-->>Connector: Response

    Connector-->>Client: Response
```

## TLS between clients and the Connector

The hostname you configure will be used to reach and use your Connector. It can be managed by Formal or by yourself.

* **Formal-Managed**: The hostname is a subdomain of a domain that belongs to Formal. Formal will create and renew the TLS certificate of your Connector.
* **Customer-Managed**: The hostname is in a DNS zone you control. You are responsible for configuring your DNS records and managing your TLS certificates.

Formal recommends using Formal-managed hostnames for simplified TLS certificate management and automatic renewal.

### Formal-Managed

Formal will automatically generate and renew the TLS certificate for your Connector if the hostname ends with \
`.[NAME_OF_YOUR_ORG].connectors.joinformal.com`.

Using our Terraform provider, you can create such a Connector hostname and specify where it should point to:

```hcl theme={null}
resource "formal_connector_hostname" "main" {
  connector_id = formal_connector.main.id
  hostname     = var.connector_hostname # e.g. "postgres.<org-name>.connectors.joinformal.com"
  dns_record   = var.dns_record # CNAME record value to point to
}
```

The DNS record you want to set here is the hostname of the load balancer you have deployed to target your Connector.

When creating the Connector hostname with the web interface, just select "Formal-Managed" and fill the form.

### Customer-Managed

For self-managed hostname and TLS, you must provide your TLS certificate to the Connector. You can do so via our APIs, Terraform, or the Formal console:

<img src="https://mintcdn.com/formal/IbIdLIRtoPmD-sm8/assets/images/customer_managed_tls_cert.png?fit=max&auto=format&n=IbIdLIRtoPmD-sm8&q=85&s=0e72b71d9a9a98e75a26d692323d8885" width="1150" height="1692" data-path="assets/images/customer_managed_tls_cert.png" />

## TLS between the Connector and Resources

You can configure TLS settings between the Connector and resources on an individual resource level via our APIs, Terraform, or the Formal console:

<img src="https://mintcdn.com/formal/fJsHlx-X_b_ATHwb/assets/images/resource_tls_configuration.png?fit=max&auto=format&n=fJsHlx-X_b_ATHwb&q=85&s=a7db2361983accfd5077a6c5cf1fe633" width="765" height="165" data-path="assets/images/resource_tls_configuration.png" />

TLS settings for connections between the Connector and Resources are configured per-resource either via the UI or Terraform. The TLS configuration can be set to one of the following options: `disable`, `insecure-skip-verify`, `insecure-verify-ca-only` (verifies certificate chain but not hostname), or `verify-full`.