diff --git a/components/common/util.go b/components/common/util.go
index 6974969..e8d0731 100644
--- a/components/common/util.go
+++ b/components/common/util.go
@@ -27,3 +27,12 @@ func LogPanic() {
 		logrus.Fatalf("%s: %s", r, debug.Stack())
 	}
 }
+
+func ArrayContains(haystack []string, needle string) bool {
+	for _, item := range haystack {
+		if item == needle {
+			return true
+		}
+	}
+	return false
+}
diff --git a/components/installer/pkg/context.go b/components/installer/pkg/context.go
index 68bc2d1..59b755d 100644
--- a/components/installer/pkg/context.go
+++ b/components/installer/pkg/context.go
@@ -39,6 +39,7 @@ type InstallerResponses struct {
 	PodSubnet               string
 	ServiceSubnet           string
 	PrivateGateway          string
+	PublicHostname          string
 	DNSDomain               string
 	StorageSystemPercentage int
 	ControllerDisk          string
diff --git a/components/installer/pkg/crypto.go b/components/installer/pkg/crypto.go
index 3efb59c..a2a0dec 100644
--- a/components/installer/pkg/crypto.go
+++ b/components/installer/pkg/crypto.go
@@ -27,6 +27,8 @@ import (
 	"github.com/cloudflare/cfssl/signer/local"
 	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
+
+	"github.com/paxautoma/operos/components/common"
 )
 
 func CreateControllerCerts(ctx *InstallerContext) error {
@@ -127,19 +129,25 @@ func createAPISigner(caCertBytes, caKeyBytes []byte) (signer.Signer, error) {
 }
 
 func createAPIServerCSR(ctx *InstallerContext) (csrBytes, keyBytes []byte, errOut error) {
+	hosts := []string{
+		ctx.Responses.ControllerIP,
+		ctx.Responses.KubeAPIServiceIP,
+		"127.0.0.1",
+		"localhost",
+		"kubernetes.default.svc",
+	}
+
+	if ctx.Responses.PublicHostname != "" && !common.ArrayContains(hosts, ctx.Responses.PublicHostname) {
+		hosts = append(hosts, ctx.Responses.PublicHostname)
+	}
+
 	req := &csr.CertificateRequest{
 		KeyRequest: &csr.BasicKeyRequest{
 			A: "rsa",
 			S: 2048,
 		},
-		Hosts: []string{
-			ctx.Responses.ControllerIP,
-			ctx.Responses.KubeAPIServiceIP,
-			"127.0.0.1",
-			"localhost",
-			"kubernetes.default.svc",
-		},
-		CN: fmt.Sprintf("%s (Controller Server)", ctx.Responses.OrgInfo.Cluster),
+		Hosts: hosts,
+		CN:    fmt.Sprintf("%s (Controller Server)", ctx.Responses.OrgInfo.Cluster),
 		Names: []csr.Name{
 			{
 				C:  ctx.Responses.OrgInfo.Country,
diff --git a/components/installer/pkg/screens/install.go b/components/installer/pkg/screens/install.go
index b3314f6..19da5ea 100644
--- a/components/installer/pkg/screens/install.go
+++ b/components/installer/pkg/screens/install.go
@@ -109,6 +109,7 @@ func InstallScreen(screenSet *widgets.ScreenSet, context interface{}) *widgets.S
 		fmt.Sprintf("OPEROS_SERVICE_CIDR=%s", ctx.Responses.ServiceSubnet),
 		fmt.Sprintf("OPEROS_PRIVATE_GW=%s", ctx.Responses.PrivateGateway),
 		fmt.Sprintf("OPEROS_DNS_SERVICE_IP=%s", ctx.Responses.DNSIP),
+		fmt.Sprintf("OPEROS_PUBLIC_HOSTNAME=%s", ctx.Responses.PublicHostname),
 		fmt.Sprintf("OPEROS_DNS_DOMAIN=%s", ctx.Responses.DNSDomain),
 		fmt.Sprintf("OPEROS_WORKER_STORAGE_PERCENTAGE=%d", ctx.Responses.StorageSystemPercentage),
 		fmt.Sprintf("OPEROS_CLUSTER_NAME=%s", ctx.Responses.OrgInfo.Cluster),
diff --git a/components/installer/pkg/screens/network.go b/components/installer/pkg/screens/network.go
index 216a40d..e8cac0b 100644
--- a/components/installer/pkg/screens/network.go
+++ b/components/installer/pkg/screens/network.go
@@ -381,8 +381,9 @@ edit the values below.`
 		widgets.NewEditableListItem("Pod subnet", "pod-subnet", ctx.Responses.PodSubnet, widgets.ValidateIPNet),
 		widgets.NewEditableListItem("Service subnet", "service-subnet", ctx.Responses.ServiceSubnet, widgets.ValidateIPNet),
 		widgets.NewEditableListItem(gatewayLabel, "private-gateway", ctx.Responses.PrivateGateway, widgets.ValidateIP),
+		widgets.NewEditableListItem("Public hostname", "public-hostname", "", nil),
 		widgets.NewEditableListItem("DNS domain", "dns-domain", ctx.Responses.DNSDomain, widgets.ValidateNotEmpty),
-	}, 80, 7)
+	}, 80, 8)
 
 	errorList := widgets.NewPar("par-errors", "")
 	errorList.Bounds = image.Rect(1, 0, 79, 3)
@@ -411,6 +412,8 @@ edit the values below.`
 			ctx.Responses.DNSDomain = item.Value
 		case "private-gateway":
 			ctx.Responses.PrivateGateway = item.Value
+		case "public-hostname":
+			ctx.Responses.PublicHostname = item.Value
 		}
 
 		validate()