> ## Documentation Index
> Fetch the complete documentation index at: https://www.aptible.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# aptible endpoints:tls:create

This command creates a new [TLS Endpoint](/docs/core-concepts/apps/connecting-to-apps/app-endpoints/tls-endpoints).

# Synopsis

```
Usage:
  aptible endpoints:tls:create SERVICE [flags]

Flags:
      --app string                       App handle
      --certificate string               Certificate common name
      --certificate-file string          Path to certificate PEM file (creates a new certificate)
      --certificate-fingerprint string   SHA256 fingerprint of an existing certificate
      --default-domain                   Use Aptible's managed wildcard domain
      --disable-weak-cipher-suites       Block the SSLv3 protocol and RC4 ciphers
  -e, --env string                       Environment handle (alias)
      --environment string               Environment handle
      --idle-timeout string              Idle timeout in seconds (or 'default' to reset)
      --internal                         Restrict this endpoint to internal traffic
      --ip-whitelist strings             IP CIDR whitelist (comma-separated or use flag multiple times)
      --managed-tls                      Use Managed TLS (requires --managed-tls-domain)
      --managed-tls-domain string        Domain for Managed TLS
      --no-default-domain                Clear the default domain setting
      --no-disable-weak-cipher-suites    Clear the disable weak cipher suites setting
      --no-internal                      Do not restrict this endpoint to internal traffic
      --no-managed-tls                   Disable Managed TLS
      --ports strings                    Container ports (comma-separated or use flag multiple times)
      --private-key-file string          Path to private key PEM file (used with --certificate-file)
      --ssl-ciphers-override string      Allowed SSL ciphers; use "default" to reset to platform default
      --ssl-protocols-override string    Allowed SSL protocols; use "default" to reset to platform default
```

# Examples

In all the examples below, `$SERVICE` represents the name of a [Service](/docs/core-concepts/apps/deploying-apps/services) for the app you add an Endpoint to.

> 📘 If your app is using an [Implicit Service](/docs/how-to-guides/app-guides/define-services#implicit-service-cmd), the service name is always `cmd`.

#### Create a new Endpoint using custom Container Ports and an existing [Custom Certificate](/docs/core-concepts/apps/connecting-to-apps/app-endpoints/custom-certificate)

In the example below, `$CERTIFICATE_FINGERPRINT` is the SHA-256 fingerprint of a [Custom Certificate](/docs/core-concepts/apps/connecting-to-apps/app-endpoints/custom-certificate) that exist in the same [Environment](/docs/core-concepts/architecture/environments) as the App you are adding an Endpoint for.

> 📘 Tip: Use the Dashboard to easily locate the Certificate Fingerprint for a given Certificate.

> ❗️ Warning: Everything after the `--ports` argument is assumed to be part of the list of ports, so you need to pass it last.

```shell theme={null}
aptible endpoints:tls:create \
        "$SERVICE" \
        --app "$APP_HANDLE" \
        --certificate-fingerprint "$CERTIFICATE_FINGERPRINT" \
        --ports 8000 8001 8002 8003
```

#### More Examples

This command is fairly similar in usage to [`aptible endpoints:https:create`](/docs/reference/aptible-cli/cli-commands/cli-endpoints-https-create). Review the examples there.