Okta: the Custom domain and TLS configuration
Tags: sso, dns, ssl
Published: 2019-10-11 06:28:45

---
title: Okta: the Custom domain and TLS configuration
published: true
date: 2019-10-04 12:19:28 UTC
tags: SSO,DNS,SSL
canonical_url: https://rtfm.co.ua/en/okta-the-custom-domain-and-tls-configuration/
---

![](https://rtfm.co.ua/wp-content/uploads/2019/09/okta-logo.png)You can use your own domain configured for Okta.

The one thing worth to mention here is the fact that Okta’s official plugin doesn’t work with a _Custom domain_ feature so you’ll have to use Okta’s URL for the plugin authentification, see the  [documentation](https://developer.okta.com/docs/guides/custom-url-domain/-/overview/#caveats) for details.

### Custom domain configuration

Go to the _Settings > Customization_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_161251.png "Okta: настройка своего домена")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_161251.png)

List down, find the _Custom URL Domain_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_161423.png "Okta: настройка своего домена")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_161423.png)

Click on the _Get Started_, specify the domain you’d like to use, in this current case – the _okta.example.com_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_161740.png "Okta: настройка своего домена")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_161740.png)

Okta will display DNS-record to be added:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_161809.png "Okta: настройка своего домена")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_161809.png)

Our domains served by the AWS Route53, go there and add the TXT-record:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_161903.png "Okta: настройка своего домена")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_161903.png)

Click the _Next_ button in the Okta.

### TLS

Now need to obtain an SSL-certificate for our domain.

Create a CSR, for example on the [https://csrgenerator.com](https://csrgenerator.com) site.

In the _Common Name_ set your domain to be used in Okta:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_163531.png "Okta: настройка своего домена")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_163531.png)

Save the result – the CSR itself and a private key

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_163602.png "Okta: настройка своего домена")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_163602.png)

Go to your SSL’s issuer, it’s the 101domains in our case, buy a new certificate and specify the CSR from the data above:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_163837.png "Okta: настройка своего домена")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_163837.png)

Validate the domain. Again it depends on an SSL’s issuer, in our case, the DNS will be used:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_163909.png "Okta: настройка своего домена")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_163909.png)

Get the record to be added:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_163935-1.png "Okta: настройка своего домена")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_163935-1.png)

Add a CNAME-record in the Route53:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_164016.png "Okta: настройка своего домена")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_164016.png)

Ready:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_164049-1.png "Okta: настройка своего домена")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_164049-1.png)

#### TLS in Okta

Now go to the Okta and configure your TLS details.

Here we need to set the Private key and the Certificate.

The private key can be found from the data we got from the [https://csrgenerator.com](https://csrgenerator.com.):

```
$ cat okta.example.com.csr
-----BEGIN CERTIFICATE REQUEST-----
MIICrDCCAZQCAQAwZzELMAkGA1UEBhMCVUExHDAaBgNVBAMME29rdGEuYmV0dGVy
...
treVmmsKjfAsO8uSIZi1d3GTsHvlwAk7RKEaYBMunhRHRKfxr3484jZMQ16kmKaJ
wRy4TH8OOomvqVbjjIwbig==
-----END CERTIFICATE REQUEST-----

-----BEGIN PRIVATE KEY-----
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDKtyAK/6LRLdi/
5/W9yid++PPXs1vTyVDgaDU34pCw4iGTxLfAHYtRzJNINP4LIfsIz6TVAhHAC0tL
...
m2hlvU3wQiy+u3yLhR1FCMympFDf0PMbcGWDEC/N1WXprdAU04AIMTm/Qh2WFCHN
MqePCzr76wgdH8CNltHkAYsv/g==
-----END PRIVATE KEY-----
```

And the certificate itself can be taken from its issuer:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_172502.png "Okta: настройка своего домена")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_172502.png)

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_172533.png "Okta: настройка своего домена")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_172533.png)

Specify both _Private key_ and _Certificate_ in Okta:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_172637.png "Okta: настройка своего домена")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_172637.png)

### DNS

The last thing – add a DNS-record with your new domain _okta.example.com_ and point it to the Okta’s URL via a CNAME-record:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_172719-1.png "Okta: настройка своего домена")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_172719-1.png)

Go to the Route53, add the record:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_172752.png "Okta: настройка своего домена")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_172752.png)

Wait for the DNS propagation and check:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_173410.png "Okta: настройка своего домена")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191002_173410.png)

From now – Okta will start using the new Custom domain for all your services.

Still, remember that you have to use the default domain for the plugin authentication.

Done.

### Similar posts
 
- <small>09/30/2019</small> [Okta: SSO authentication for Gmail and Slack](https://rtfm.co.ua/en/okta-sso-authentication-for-gmail-and-slack/)  
- <small>03/20/2018</small> [What is: SSL/TLS в деталях](https://rtfm.co.ua/what-is-ssl-tls-v-detalyax/)  
- <small>05/01/2019</small> [Bitwarden: an organization’s password manager self-hosted version installation on an AWS EC2](https://rtfm.co.ua/en/bitwarden-an-organizations-password-manager-self-hosted-version-installation-on-an-aws-ec2/)