---
title: "TLS & Certificates"
description: "How Rivet validates TLS root certificates."
skill: true
---

Public CAs (Let's Encrypt, AWS ACM, and so on) work out of the box. You only need to read this page if you're running behind a corporate or private CA.

Rivet reads the operating system trust store (`/etc/ssl/certs` on Linux, Keychain on macOS, Schannel on Windows) for all outbound HTTPS. Operator-installed corporate CAs live there and are honored automatically.

To trust a private CA inside the official `rivetdev/engine` image, extend it the standard Debian way:

```dockerfile
FROM rivetdev/engine:latest
COPY my-corp-ca.crt /usr/local/share/ca-certificates/
RUN update-ca-certificates
```

Rebuild and redeploy. The same approach works for any machine running a Rivet client: install the CA into the OS trust store and Rivet picks it up.
