:_mod-docs-content-type: ASSEMBLY
[id="replacing-default-ingress"]
= Replacing the default ingress certificate
include::_attributes/common-attributes.adoc[]
:context: replacing-default-ingress

[role="_abstract"]
To allow external clients to connect securely to applications under the .apps subdomain in {product-title}, you can replace the default wildcard ingress certificate with one issued by a trusted public CA.

toc::[]

include::modules/customize-certificates-understanding-default-router.adoc[leveloffset=+1]

include::modules/customize-certificates-replace-default-router.adoc[leveloffset=+1]


[role="_additional-resources"]
== Additional resources

* xref:../../security/certificates/updating-ca-bundle.adoc#ca-bundle-understanding_updating-ca-bundle[Replacing the CA Bundle certificate]
* xref:../../security/certificate_types_descriptions/proxy-certificates.adoc#proxy-cert-customization_proxy-certificates[Proxy certificate customization]
