> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/managing-account/add-a-custom-ca-certificate.md).

# Add a custom CA certificate

How to configure a custom CA certificate

## Trust a custom CA certificate

If your organization issues web certificates from an internal Certificate Authority (CA) rather than a publicly trusted one, you can upload your internal CA once at the account level so Snyk validates certificates against it, just as it validates against public CAs.

Snyk still reports certificates that do not chain to either the public trust store or your uploaded CA as untrusted.

### Configure the trusted CA

Uploading, replacing, or removing the trusted CA requires the **Account Settings** permission. Any user who can open the Scan Settings page can view the configured certificate details, even without this permission.

1. From the side menu in your Snyk API & Web account, navigate to **Settings > Scan Settings**.
2. Locate the **TRUSTED CA CERTIFICATE** module.
3. Click **Upload** and select a Privacy-Enhanced Mail (PEM) file containing your CA certificate.
   * If your organization uses a multi-tier public key infrastructure (PKI) with a Root CA and one or more Intermediate CAs, you can include any number of these certificates in the PEM file. If your Root CA is internal and not publicly trusted, make sure it is included in the uploaded PEM file, so Snyk can validate trust.
4. Verify that the certificate details Snyk extracts and displays match your CA, then confirm the upload:
   * **Common Name**
   * **Issuer**
   * **SHA-256 fingerprint**
   * **Expiry date**

After you upload the certificate, every scan across every target in the account validates server certificates against both your CA and the public trust store.

### Replace or remove the trusted CA

* To replace it: click **Upload** and select a new PEM file. This replaces the existing configuration entirely.
* To remove it: click **Remove**. This returns the account to the default public trust store.

The [account audit log](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/managing-account/generate-and-use-audit-log-reports) records both actions, including the user and timestamp, providing an audit trail for untrusted-certificate findings.

### Certificate expiry

* If the file you upload contains a certificate that has already expired, Snyk rejects the upload and explains why. An expired CA cannot establish trust, so Snyk does not store it.
* If a certificate you have already uploaded expires while in use, Snyk flags it in the module. Upload a renewed certificate to restore trust.

### Troubleshooting

| Scenario                                                       | What you will see                                                                                                       | What to do                                                                                |
| -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
| The uploaded file is not valid PEM, or contains no certificate | "This file does not contain a valid certificate. Upload a PEM file containing your CA certificate."                     | Re-export your CA certificate in PEM format and upload again.                             |
| The uploaded certificate has already expired                   | "This certificate expired on \[date] and cannot be used to establish trust."                                            | Upload your current CA certificate.                                                       |
| A stored certificate has expired                               | The certificate row is flagged as expired, with a message that affected findings will return.                           | Upload the renewed CA certificate.                                                        |
| You do not have permission to make changes                     | "You do not have permission to change these settings. Please contact the account owner if you need to change anything." | Ask an account owner, or a user with the Account Settings permission, to make the change. |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/managing-account/add-a-custom-ca-certificate.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.