Public Heliont deployments need a TLS certificate that covers your primary domain and Heliont service hostnames. Local installs do not need this — choose Local in the installer (or omit TLS files in the Linux prep folder) and a self-signed certificate is created for you.
Copy certificates for Linux CLI public install
On Linux CLI installs, copy the full-chain PEM and private key into the same prep folder as your license before you run the installer. Preferred filenames: fullchain.pem and privkey.pem.
# on the server mkdir -p ~/heliont-prep
# from your laptop scp fullchain.pem privkey.pem user@server:~/heliont-prep/ scp heliont-license.json user@server:~/heliont-prep/
Then from that folder:
cd ~/heliont-prep sudo ./heliont-install-linux-amd64 -domain heliont.example.com
The installer discovers the PEMs in the current directory. See the full flow in Linux CLI installation.
Where to find the required names in the graphical installer
- Start the Heliont Installer and continue to the Access step.
- Select Public.
- Enter your primary Domain (for example heliont.example.com).
- Open the information control on the Public tile (the i button).
The dialog Required certificate names lists every DNS name your certificate must include for the domain you entered. Use that list when you request or renew the certificate.
You can also open this documentation from that dialog via Open documentation.
Required names
For domain example.com, include at least:
- example.com
- www.example.com
- tenant.example.com
- *.tenant.example.com
- cdn.example.com
Replace example.com with the domain you type into the installer (or pass with -domain). The installer validates that your certificate covers these names before you can continue.
How to obtain a certificate
- Use a public certificate authority (for example Let’s Encrypt) or your corporate PKI.
- Request a certificate that includes all names from the list above (as Subject Alternative Names).
- Download:
- the full-chain certificate in PEM format
- the matching private key in PEM format
- In the graphical installer Access step (Public), browse to both files — or on Linux CLI, place them in the prep folder and pass -domain.
Tips
- Prefer a single certificate that covers every required name (including the wildcard for *.tenant.…).
- Keep the private key secure; only the installer host needs it.
- If validation fails, open the certificate details in the installer and compare Included DNS names with the required list.
Local access
Choose Local when installing for development, demos, or a machine that will only be reached as localhost. No external certificate is required. Your browser will show a warning for the self-signed certificate — that is expected.