Postman SSL Certificates

HTTPS protects the data that travels between Postman and a server. The protection depends on certificates, digital identity cards that prove a server is genuine. Test environments often use unusual certificates, which causes errors in Postman. Understanding certificates helps you fix those errors safely.

Why Certificates Exist

Imagine sending a parcel to a stranger who claims to be your bank. You would want proof. A certificate provides that proof. A trusted authority signs the certificate, and Postman checks the signature before sending data.

  Postman: "Prove who you are."
  Server : "Here is my certificate, signed by a trusted authority."
  Postman: checks the signature, the name, and the expiry date
     │
     ├── All correct ──► Encrypted connection opens
     └── Any problem ──► Error: could not get local issuer certificate
                         or: self-signed certificate

Common Certificate Errors

Error Message	Likely Cause
Self-signed certificate	The server created its own certificate, common on internal test servers
Unable to verify the first certificate	The server did not send the full certificate chain
Certificate has expired	The validity date has passed
Hostname mismatch	The certificate names a different domain than the URL

Turn Off Verification for Testing

Postman allows you to skip certificate checks. Use this option only for local or internal test servers that you control.

1. Open Settings from the gear icon.
2. Select the General tab.
3. Switch SSL certificate verification to OFF.
4. Send the request again.

Postman also offers a per-request toggle in the request settings area. Prefer the per-request toggle because it limits the exception to one call.

Never disable verification when you handle real user data or contact public production servers. Disabled checks remove the protection HTTPS provides.

Add a Custom CA Certificate

Companies often run a private certificate authority. Adding that authority to Postman is safer than disabling checks.

1. Open Settings and choose the Certificates tab.
2. Enable CA Certificates.
3. Select the PEM file supplied by your IT team.

Postman now trusts every server signed by that authority while still rejecting unknown ones.

Client Certificates

Some APIs demand that the client prove its identity too. This setup is called mutual TLS. The server asks Postman for a certificate, and Postman answers with one of your own.

  Postman ────── "Here is MY certificate" ─────► Server
  Postman ◄───── "Here is MINE" ─────────────── Server
  Both sides verified ──► Secure channel opens

Add a Client Certificate

1. Open Settings and the Certificates tab.
2. Click Add Certificate.
3. Type the host, such as secure.example.com.
4. Select the CRT file and the KEY file, or a PFX file with its passphrase.
5. Click Add.

Postman presents the certificate automatically whenever a request targets that host.

Certificate File Types

• PEM: readable text format that starts with a BEGIN CERTIFICATE line.
• CRT: certificate file, often PEM inside.
• KEY: the private key that matches a certificate. Guard it carefully.
• PFX or P12: a bundle holding the certificate and the key behind a passphrase.

Safe Practices

• Keep private key files out of shared folders and code repositories.
• Prefer a custom CA certificate over turning verification off.
• Renew certificates before the expiry date.
• Test the full certificate chain with a browser or a command-line tool when errors persist.

Key Points

• Certificates prove that a server is genuine.
• Self-signed and expired certificates trigger Postman errors.
• Disabling verification suits only controlled test servers.
• Custom CA files let Postman trust private company authorities.
• Client certificates support mutual TLS for strict APIs.