# Use HTTPS in front of the HTTP interface

Coordinator DB has no built-in TLS listener. A certificate cannot be enabled by adding undocumented SSL fields to `config.xml`. Use trusted connectivity or an external secure transport when credentials and SQL need protection in transit.

For an HTTPS browser endpoint, an externally managed TLS terminator can accept the browser connection and forward requests to the configured HTTP listener. Certificate issuance and renewal belong to that external service. Bind the database listener to the intended private address and prevent callers from bypassing the secure entry point.

Preserve the documented request semantics. Browser requests must satisfy matching Origin and Host rules; the server emits no CORS headers. Basic credentials and Bearer keys belong in Authorization, never URL parameters. Check ordinary SQL requests, attached uploads and returned error statuses through the actual endpoint before relying on it.

A `/ping` response proves only health-check reachability and does not test authentication. Verify an authenticated SELECT separately and ensure failures remain visible to the caller. Use the response query ID when diagnosing a forwarded request.

See [HTTP behavior](https://coordinatordb.com/docs/concepts/features/interfaces/http), [network access](https://coordinatordb.com/docs/concepts/features/security) and [listener configuration](https://coordinatordb.com/docs/concepts/features/security/network-ports).