# How to authenticate host service via tls **URL:** \ **Category:** Ziti Overlay\ **Created:** [June 18, 2024, 12:40am UTC](https://openziti.discourse.group/t/how-to-authenticate-host-service-via-tls/2737 "2024-06-18T00:40:23Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\ **Post date:** [June 18, 2024, 12:40am UTC](https://openziti.discourse.group/t/how-to-authenticate-host-service-via-tls/2737/1 "2024-06-18T00:40:23Z")
I have a host service that uses tls for password authentication , so while mapping that host service how do I fulfil its tls requirement in openziti ? ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [June 18, 2024, 12:22pm UTC](https://openziti.discourse.group/t/how-to-authenticate-host-service-via-tls/2737/2 "2024-06-18T12:22:21Z")
I'm not sure what you're asking. If you are using TLS, you just configure the server to provide a certificate and / or do the same at the client side. I don't understand what you're actually asking here. To form a TLS connection over ziti, whatever intercept you choose, that certificate simply needs to be served from the side the client is connecting to. If you intercept "my.ziti.test" -- the server needs to return a cert that is valid for "my.ziti.test". It'll 'just work'. ---
**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\ **Post date:** [June 18, 2024, 12:29pm UTC](https://openziti.discourse.group/t/how-to-authenticate-host-service-via-tls/2737/3 "2024-06-18T12:29:09Z")
Let's say I'm using trino service which requires tls for pass authentication . If its url was `trino.default.svc` I want to connect it as `https://trino.default.svc` even if intercept (ziti domain) like `trino.ziti.internal` can be http . I know what I'm asking is bit uncommon but what if some applications like trino support password authentication only via tls I want service to present a certificate and request it via `https` to trino endpoint Do correct me if I miss something ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [June 18, 2024, 12:33pm UTC](https://openziti.discourse.group/t/how-to-authenticate-host-service-via-tls/2737/4 "2024-06-18T12:33:43Z")
If you have a service that requires TLS and only serves TLS like "[https://trino.default.svc](https://trino.default.svc)" then when a user tries to go to "[http://trino.ziti.internal](http://trino.ziti.internal)" it will get a protocol violation error and no connection will be established. So the easy way of dealing with this is to only offload from the openziti overlay towards the HTTPS/TLS port and no HTTP request can ever be made. ---
**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\ **Post date:** [June 18, 2024, 12:50pm UTC](https://openziti.discourse.group/t/how-to-authenticate-host-service-via-tls/2737/5 "2024-06-18T12:50:04Z")
ok what if I keep ziti url also https here ? ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [June 18, 2024, 1:04pm UTC](https://openziti.discourse.group/t/how-to-authenticate-host-service-via-tls/2737/6 "2024-06-18T13:04:16Z")
To be clear, **only** https will work properly in the situation you described. So if you use http -- it will not work. There is no way for you to perform a scheme change with ziti. it must be http-\>http or https-\>https. ---
**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\ **Post date:** [June 18, 2024, 1:07pm UTC](https://openziti.discourse.group/t/how-to-authenticate-host-service-via-tls/2737/7 "2024-06-18T13:07:02Z")
yes in case of https-\>https could you please guide me how do I do it ? ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [June 18, 2024, 1:22pm UTC](https://openziti.discourse.group/t/how-to-authenticate-host-service-via-tls/2737/8 "2024-06-18T13:22:24Z")
It's exactly like every other service. Just make sure the clients type "https" and make sure your bind config sends traffic to the https port and the rest is all the same. ---
**Author:** ![sadath-12](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/sadath-12/32/2043_2.png) [@sadath-12](https://openziti.discourse.group/u/sadath-12)\ **Post date:** [June 18, 2024, 2:34pm UTC](https://openziti.discourse.group/t/how-to-authenticate-host-service-via-tls/2737/9 "2024-06-18T14:34:30Z")
sure ill try thanks @TheLumberjack