Add and manage CA and client certificates in Postman

You can add and manage certificates in Postman to enable authentication when sending requests.

To connect to an API that uses Mutual TLS (mTLS), you need to add a client certificate to Postman. Mutual TLS is an authentication method that requires both the client and the server to confirm their identity with a certificate. Once the identity of both parties is confirmed, an encrypted connection is established.

You can also add a custom CA certificate to Postman. If an endpoint uses a certificate that's registered with an internal certificate registry, requests sent from Postman will fail with SSL Error: Self signed certificate. Adding a custom CA certificate will enable you to send requests to the endpoint without needing to turn off SSL verification.

If you're using the Postman web app to add and manage certificates, you must use the Postman Desktop Agent.

Managing certificates

In the Postman settings, you can view installed certificates, add a new certificate, or remove a certificate.

1. Select the settings icon in the header and select Settings.
2. Select the Certificates tab.

Adding CA certificates

To avoid "self signed certificate" errors when sending requests, add your custom CA certificate to Postman.

1. Turn on the toggle next to CA Certificates.
2. Select the PEM file for your CA certificate. (The PEM file can contain multiple CA certificates.)

Adding client certificates

To send requests to an API that uses mutual TLS authentication, add your client certificate to Postman.

1. Select Add Certificate.

2. Enter the Host domain for the certificate (don't include the protocol). For example, enter postman-echo.com to send requests to the Postman Echo API.

   The Host field supports pattern matching. If you enter *.example.com, the same client certificate will be used for all example.com subdomains.

3. (Optional) Enter a custom port number to associate with the domain. If you don't specify a port, Postman uses the default HTTPS port (443).

4. Select the CRT file and the Key file for your certificate OR select the PFX file for your certificate.

5. If you used a Passphrase when generating the client certificate, enter it in the box. Otherwise, leave the box blank.

6. Select Add.

Each client certificate is specific to a domain. To send requests to more domains, add the appropriate certificate for each domain. Don't add more than one certificate for the same domain. If you add more than one certificate for a domain, Postman will use the last certificate added.

Editing a certificate

You can't edit a certificate after adding it. To make changes, first remove the certificate, then generate a new certificate and add it to Postman.

Let's Encrypt SSL certificates have a lifetime of 90 days. Let's Encrypt recommends using an ACME client to automatically renew your certificate every 60 days.

Removing a certificate

Remove a certificate if you no longer need it to send requests from Postman.

• To remove a CA certificate, select the remove icon next to the certificate.
• To remove a client certificate, select the delete icon next to the certificate.

Using a certificate

After adding a client certificate, you don't have to perform any extra steps to use the certificate in Postman. When you make an HTTPS request to a configured domain, Postman automatically sends the client certificate with the request. The certificate is sent using OpenSSL handling, and Postman doesn't change the certificate.

Postman won't send the certificate if you make an HTTP request.

Confirming a certificate was sent

You can confirm that a certificate was sent using the Postman Console. Open the Postman Console by selecting Console in the Postman footer, and then send a request.

In the example below, Postman sent the certificate because the request used https://. You can expand the request to view details about the certificate that was sent with the request.

Viewing certificate details

You can view more certificate details in the response pane. The network icon includes a padlock if a request was sent using HTTPS. Hover over the network icon to view information about the certificate that was sent with the request, and any warnings or errors such as self-signed or expired certificates.

Troubleshooting certificate errors

If certificate verification fails when sending a request, Postman displays an error message in the response pane. To fix the error, turn off SSL verification for the request.

To turn off SSL verification for the request, do the following:

1. Open the request and select the Settings tab.
2. Toggle Enable SSL certificate verification to OFF.
3. Send the request again.

You can turn off SSL verification globally in the Postman settings on the General tab.

If SSL verification is turned off, you can hover over the network icon in the response pane to get details about any certificate errors or warnings.

You can also find more information about certificate errors in the Postman Console.