# TLS & Certificates

> Source: `src/content/docs/self-hosting/tls.mdx`
> Canonical URL: https://rivet.dev/docs/self-hosting/tls
> Description: How Rivet validates TLS root certificates.

---
Public CAs (Let's Encrypt, AWS ACM, and so on) work out of the box. You only need to read this page if you're running behind a corporate or private CA.

Rivet reads the operating system trust store (`/etc/ssl/certs` on Linux, Keychain on macOS, Schannel on Windows) for all outbound HTTPS. Operator-installed corporate CAs live there and are honored automatically.

To trust a private CA inside the official `rivetdev/engine` image, extend it the standard Debian way:

```dockerfile
FROM rivetdev/engine:latest
COPY my-corp-ca.crt /usr/local/share/ca-certificates/
RUN update-ca-certificates
```

Rebuild and redeploy. The same approach works for any machine running a Rivet client: install the CA into the OS trust store and Rivet picks it up.

_Source doc path: /docs/self-hosting/tls_