Listener TLS
Encrypt the hop from your proxy to Janus: an issued certificate, or a temporary self-signed one.
Options
By default Janus serves plain HTTP and your ingress or load balancer terminates TLS (declare it in JANUS_TRUSTED_PROXIES). To encrypt the hop from the proxy to Janus too, have Janus serve TLS itself.
Issued certificate: JANUS_TLS_CERT_PATH and JANUS_TLS_KEY_PATH (for example a mounted kubernetes.io/tls Secret, such as one from cert-manager). Renewals are picked up without a restart.
Self-signed: JANUS_TLS_SELF_SIGNED=true. Janus generates the certificate on first start and stores it encrypted in the database, so every replica serves the same one. Names: JANUS_TLS_SELF_SIGNED_NAMES; lifetime: JANUS_TLS_SELF_SIGNED_DAYS (1–1095, default 365).
Strict mode: JANUS_TLS_REQUIRE=true refuses to start unless Janus serves TLS itself.
Self-signed: temporary by design
Use it for testing, or while an issued certificate is on its way. Under Administration → Settings → Certificates → Janus listener, download the certificate and install it in the proxy as the certificate to trust for the Janus backend.
Regenerate makes a new certificate, served at once (every replica within a minute). Install the new one in the proxy; until then the proxy cannot verify Janus. Regeneration is audited.
Administrators are alerted when the listener certificate is within 30 days of expiry and when it expires. In the STIG profile a self-signed listener certificate is reported as a deviation from the DoD PKI requirement.