Custom certificate authorities
Configure per-monitor TLS trust with PEM certificate bundles.
HTTPS, raw TLS, SMTP-over-TLS/STARTTLS, and WSS monitors can extend the worker's system trust store with a per-monitor certificate-authority bundle. Paste up to ten PEM certificates in the Custom certificate authority section of the monitor editor's Checks tab.
The bundle is encrypted and shown as a write-only marker after saving. Leaving the marker in place preserves the bundle during later edits; clearing it removes the custom trust. Non-certificate content, oversized bundles, and CA settings on non-TLS monitor types are rejected.
The custom roots apply to:
- HTTPS requests, including requests tunneled through an outbound proxy;
- direct TLS certificate monitors;
- SMTP implicit-TLS and STARTTLS handshakes;
- WSS upgrade handshakes.
Existing hostname verification and Verify TLS certificate controls still apply. Use the narrowest issuing CA possible rather than a broad internal root, rotate bundles before certificates change, and treat exported monitor packages as secret-bearing.