TLS Configuration

Argo CD provides three inbound TLS endpoints that should be configured with proper certificates. By default, these endpoints use automatically generated, self-signed certificates.

Quick Reference

Certificate Configuration

Component	Secret Name	Hot Reload	Default Cert	Required SAN Entries
`argocd-server`	`argocd-server-tls`	✅ Yes	Self-signed	External hostname (e.g., `argocd.example.com`)
`argocd-repo-server`	`argocd-repo-server-tls`	❌ Restart required	Self-signed	`DNS:argocd-repo-server`, `DNS:argocd-repo-server.argocd.svc`
`argocd-dex-server`	`argocd-dex-server-tls`	❌ Restart required	Self-signed	`DNS:argocd-dex-server`, `DNS:argocd-dex-server.argocd.svc`

Inter-Component TLS

Connection	Strict TLS Parameter	Plain Text Parameter	Default Behavior
`argocd-server` → `argocd-repo-server`	`--repo-server-strict-tls`	`--repo-server-plaintext`	Non-validating TLS
`argocd-server` → `argocd-dex-server`	`--dex-server-strict-tls`	`--dex-server-plaintext`	Non-validating TLS
`argocd-application-controller` → `argocd-repo-server`	`--repo-server-strict-tls`	`--repo-server-plaintext`	Non-validating TLS
`argocd-applicationset-controller` → `argocd-repo-server`	`--repo-server-strict-tls`	`--repo-server-plaintext`	Non-validating TLS
`argocd-notifications-controller` → `argocd-repo-server`	`--argocd-repo-server-strict-tls`	`--argocd-repo-server-plaintext`	Non-validating TLS

Configuring argocd-server TLS

Inbound TLS Options

Configure TLS parameters for the API server:

Parameter	Default	Description
`--insecure`	`false`	Disables TLS completely
`--tlsminversion`	`1.2`	Minimum TLS version offered to clients
`--tlsmaxversion`	`1.3`	Maximum TLS version offered to clients
`--tlsciphers`	`TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_RSA_WITH_AES_256_GCM_SHA384`	Colon-separated list of cipher suites

apiVersion: apps/v1
kind: Deployment
metadata:
  name: argocd-server
  namespace: argocd
spec:
  template:
    spec:
      containers:
      - name: argocd-server
        command:
        - argocd-server
        - --tlsminversion=1.2
        - --tlsmaxversion=1.3

Certificate Priority

Argo CD determines which certificate to use in this order:

argocd-server-tls Secret

Recommended: Dedicated TLS secret for argocd-server

kubectl create -n argocd secret tls argocd-server-tls \
  --cert=/path/to/cert.pem \
  --key=/path/to/key.pem

This secret is safe to manage via third-party tools like cert-manager or Sealed Secrets.

argocd-secret Secret

Deprecated: Legacy location for TLS certificateOnly used if argocd-server-tls doesn’t exist. Not recommended for new deployments.

Auto-generated Certificate

If neither secret contains a certificate, Argo CD generates and persists a self-signed certificate in argocd-secret.

Argo CD automatically detects changes to argocd-server-tls without requiring a restart.

Using cert-manager

Automate certificate management with cert-manager:

Let's Encrypt
Internal CA

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: argocd-server-tls
  namespace: argocd
spec:
  secretName: argocd-server-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
  - argocd.example.com
  duration: 2160h # 90 days
  renewBefore: 360h # 15 days

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: argocd-server-tls
  namespace: argocd
spec:
  secretName: argocd-server-tls
  issuerRef:
    name: internal-ca
    kind: ClusterIssuer
  commonName: argocd.example.internal
  dnsNames:
  - argocd.example.internal
  - argocd.argocd.svc
  - argocd.argocd.svc.cluster.local
  duration: 8760h # 1 year
  renewBefore: 720h # 30 days

Configuring argocd-repo-server TLS

Inbound TLS Options

Parameter	Default	Description
`--disable-tls`	`false`	Disables TLS completely
`--tlsminversion`	`1.2`	Minimum TLS version
`--tlsmaxversion`	`1.3`	Maximum TLS version
`--tlsciphers`	`TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_RSA_WITH_AES_256_GCM_SHA384`	Cipher suites

Certificate Configuration

Create the argocd-repo-server-tls secret:

kubectl create -n argocd secret tls argocd-repo-server-tls \
  --cert=/path/to/cert.pem \
  --key=/path/to/key.pem

Important: The certificate must include the correct SAN entries:

DNS:argocd-repo-server
DNS:argocd-repo-server.argocd.svc
DNS:argocd-repo-server.argocd.svc.cluster.local

Self-Signed Certificates

If using a self-signed certificate, add the CA certificate:

# Generate CA
openssl genrsa -out ca.key 4096
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt \
  -subj "/CN=ArgoCD CA"

# Generate server certificate
openssl genrsa -out tls.key 2048
openssl req -new -key tls.key -out tls.csr \
  -subj "/CN=argocd-repo-server" \
  -addext "subjectAltName=DNS:argocd-repo-server,DNS:argocd-repo-server.argocd.svc"

openssl x509 -req -in tls.csr -CA ca.crt -CAkey ca.key \
  -CAcreateserial -out tls.crt -days 365 \
  -extfile <(printf "subjectAltName=DNS:argocd-repo-server,DNS:argocd-repo-server.argocd.svc")

Unlike argocd-server, argocd-repo-server requires a pod restart to pick up certificate changes.

Enable Strict TLS Validation

By default, components use non-validating TLS connections to argocd-repo-server. To enable strict validation:

Create Persistent Certificate

Create the argocd-repo-server-tls secret as shown above.

Restart repo-server

kubectl rollout restart deployment argocd-repo-server -n argocd

Enable Strict TLS

Add --repo-server-strict-tls parameter to connecting components:

# For argocd-server
spec:
  containers:
  - name: argocd-server
    command:
    - argocd-server
    - --repo-server-strict-tls

# For argocd-application-controller
spec:
  containers:
  - name: argocd-application-controller
    command:
    - argocd-application-controller
    - --repo-server-strict-tls

# For argocd-applicationset-controller
spec:
  containers:
  - name: argocd-applicationset-controller
    command:
    - argocd-applicationset-controller
    - --repo-server-strict-tls

# For argocd-notifications-controller
spec:
  containers:
  - name: argocd-notifications-controller
    command:
    - argocd-notifications-controller
    - --argocd-repo-server-strict-tls

Certificate Expiry: Ensure certificates have adequate lifetime. When replacing certificates, all workloads must be restarted.

Configuring argocd-dex-server TLS

Inbound TLS Options

Parameter	Default	Description
`--disable-tls`	`false`	Disables TLS completely

Certificate Configuration

Create the argocd-dex-server-tls secret:

kubectl create -n argocd secret tls argocd-dex-server-tls \
  --cert=/path/to/cert.pem \
  --key=/path/to/key.pem

Similar to repo-server, include correct SAN entries:

DNS:argocd-dex-server
DNS:argocd-dex-server.argocd.svc

Enable Strict TLS Validation

Create Certificate

Create the argocd-dex-server-tls secret.

Restart dex-server

kubectl rollout restart deployment argocd-dex-server -n argocd

Enable Strict TLS in argocd-server

spec:
  containers:
  - name: argocd-server
    command:
    - argocd-server
    - --dex-server-strict-tls

Service Mesh / mTLS Configuration

In service mesh environments with sidecar proxies (e.g., Istio, Linkerd), you may want to disable TLS between Argo CD components and let the mesh handle encryption.

Disable TLS to repo-server

Configure repo-server

Disable TLS and restrict to loopback:

spec:
  containers:
  - name: argocd-repo-server
    command:
    - argocd-repo-server
    - --disable-tls
    - --listen=127.0.0.1

Listening on localhost prevents direct network access while allowing sidecar communication.

Configure Clients

Set plaintext mode on all clients:

# argocd-server, argocd-application-controller, argocd-applicationset-controller
- --repo-server-plaintext

# argocd-notifications-controller
- --argocd-repo-server-plaintext

Configure Service Address

Point to sidecar proxy instead of direct service:

- --repo-server=localhost:8081

Disable TLS to dex-server

Configure dex-server

spec:
  containers:
  - name: argocd-dex-server
    command:
    - argocd-dex
    - rundex
    - --disable-tls

Configure argocd-server

spec:
  containers:
  - name: argocd-server
    command:
    - argocd-server
    - --dex-server-plaintext
    - --dex-server=localhost:5556

Complete Configuration Examples

Production Setup with cert-manager

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx

Internal PKI Setup

Step-by-Step Internal PKI Configuration

Create internal CA

# Generate root CA
openssl genrsa -out rootCA.key 4096
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 3650 \
  -out rootCA.crt -subj "/CN=ArgoCD Internal CA"

Install CA as cluster resource

kubectl create secret generic argocd-ca \
  --from-file=ca.crt=rootCA.crt \
  -n argocd

Configure cert-manager with internal CA

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: internal-ca
spec:
  ca:
    secretName: argocd-ca

Request certificates Use the Certificate resources shown in previous examples.

Troubleshooting

Certificate not picked up

Symptom: New certificate not being usedSolution:

For argocd-server: Wait up to 60 seconds (hot reload)

For argocd-repo-server and argocd-dex-server: Restart pods

kubectl rollout restart deployment argocd-repo-server -n argocd
kubectl rollout restart deployment argocd-dex-server -n argocd

TLS handshake errors

Symptom: x509: certificate is valid for X, not YSolution: Ensure SAN entries match the DNS names used by clients:

# Check certificate SANs
kubectl get secret argocd-repo-server-tls -n argocd -o json | \
  jq -r '.data["tls.crt"]' | base64 -d | \
  openssl x509 -noout -text | grep -A1 "Subject Alternative Name"

Self-signed certificate errors

Symptom: x509: certificate signed by unknown authoritySolutions:

Add ca.crt to the TLS secret
Enable strict TLS validation with proper CA trust
Or use --repo-server-plaintext if in service mesh

cert-manager not issuing

Check certificate status:

kubectl describe certificate argocd-server-tls -n argocd
kubectl get certificaterequest -n argocd

Common issues:

DNS not resolving for ACME challenges
Rate limiting from Let’s Encrypt
Incorrect issuer configuration

Best Practices

Use cert-manager

Automate certificate lifecycle management and rotation

Enable Strict TLS

Validate certificates for inter-component communication

Monitor Expiry

Set up alerts for certificates expiring within 30 days

Use Strong Ciphers

Configure TLS 1.2+ and modern cipher suites only

Never commit private keys to Git. Use secret management solutions like Sealed Secrets or External Secrets Operator.

Security Overview

Comprehensive security architecture and threat model

Secrets Management

Best practices for managing secrets

Signed Releases

Verify Argo CD artifacts and images

cert-manager

Kubernetes certificate management

Get Started

Installation

Core Features

Configuration

Application Management

ApplicationSet

Manifest Sources

Operations

Security

​Quick Reference

​Certificate Configuration

​Inter-Component TLS

​Configuring argocd-server TLS

​Inbound TLS Options

​Certificate Priority

​Using cert-manager

​Configuring argocd-repo-server TLS

​Inbound TLS Options

​Certificate Configuration

​Self-Signed Certificates

​Enable Strict TLS Validation

​Configuring argocd-dex-server TLS

​Inbound TLS Options

​Certificate Configuration

​Enable Strict TLS Validation

​Service Mesh / mTLS Configuration

​Disable TLS to repo-server

​Disable TLS to dex-server

​Complete Configuration Examples

​Production Setup with cert-manager

​Internal PKI Setup

​Troubleshooting

​Best Practices

Use cert-manager

Enable Strict TLS

Monitor Expiry

Use Strong Ciphers

​Related Resources

Security Overview

Secrets Management

Signed Releases

cert-manager

Quick Reference

Certificate Configuration

Inter-Component TLS

Configuring argocd-server TLS

Inbound TLS Options

Certificate Priority

Using cert-manager

Configuring argocd-repo-server TLS

Inbound TLS Options

Certificate Configuration

Self-Signed Certificates

Enable Strict TLS Validation

Configuring argocd-dex-server TLS

Inbound TLS Options

Certificate Configuration

Enable Strict TLS Validation

Service Mesh / mTLS Configuration

Disable TLS to repo-server

Disable TLS to dex-server

Complete Configuration Examples

Production Setup with cert-manager

Internal PKI Setup

Troubleshooting

Best Practices

Related Resources