# Add and manage CA and client certificates in Postman
You can add and manage certificates in Postman to enable authentication when sending requests. Certificates added to Postman are stored locally and aren't synced to the Postman cloud.
To connect to an API that uses Mutual TLS (mTLS), you need to add a client certificate to Postman. Mutual TLS is an authentication method that requires both the client and the server to confirm their identity with a certificate. Once the identity of both parties is confirmed, an encrypted connection is established.
You can also add a custom CA certificate to Postman. If an endpoint uses a certificate that's registered with an internal certificate registry, requests sent from Postman will fail with the "SSL Error: Self signed certificate" error message. Adding a custom CA certificate will enable you to send requests to the endpoint without needing to [turn off SSL verification](#troubleshoot-certificate-errors).
If you're using the Postman web app to add and manage certificates, you must use the [Postman Desktop Agent](/docs/getting-started/basics/about-postman-agent/#postman-desktop-agent). Postman recommends you [use the latest version](/docs/getting-started/basics/about-postman-agent/#update-the-postman-desktop-agent) of the Postman Desktop Agent to receive recent changes and improvements.
## Manage certificates
In the [Postman settings](/docs/getting-started/installation/settings/), you can view installed certificates, add a new certificate, or remove a certificate.
To access settings for certificates, do the following:
1. In the header, select 
**Settings**.
2. Select the **Certificates** tab.
You can use the [Postman VS Code extension](/docs/developer/vs-code-extension/overview/) to manage CA and client certificates.
## Add a CA certificate
To avoid "Self signed certificate" errors when sending requests, add your custom CA certificate to Postman.
1. Turn on the **CA certificates** toggle.
2. Select the **PEM file** for your CA certificate. (The PEM file can contain multiple CA certificates.)
## Add a client certificate
To send requests to an API that uses mutual TLS authentication, add your client certificate to Postman.
1. Select **Add Certificate**.
2. Enter the **Host** domain for the certificate (don't include the protocol). For example, enter "postman-echo.com" to send requests to the [Postman Echo API](https://www.postman.com/postman/published-postman-templates/documentation/ae2ja6x/postman-echo).
The **Host** field supports pattern matching. If you enter "\*.example.com", the same client certificate will be used for all example.com subdomains.
3. (Optional) Enter a custom port number to associate with the domain. If you don't specify a port, Postman uses the default HTTPS port (443).
4. Select the **CRT file** and the **Key file** for your certificate, or select the **PFX file** for your certificate.
5. If you used a **Passphrase** when generating the client certificate, enter it in the box. Otherwise, leave the box blank.
6. Select **Add**.
Each client certificate is specific to a domain. To send requests to more domains, add the appropriate certificate for each domain. Don't add more than one certificate for the same domain. If you add more than one certificate for a domain, Postman will use the last certificate added.
### Edit a certificate
You can't edit a certificate after adding it. To make changes, first [remove the certificate](#remove-a-certificate), then generate a new certificate and add it to Postman.
[Let's Encrypt](https://letsencrypt.org/) SSL certificates have a lifetime of 90 days. Let's Encrypt recommends using an [ACME client](https://letsencrypt.org/docs/client-options/) to automatically renew your certificate every 60 days.
### Remove a certificate
Remove a certificate if you no longer need it to send requests from Postman.
* To remove a CA certificate, select 
**Remove** next to the certificate.
* To remove a client certificate, select 
**Delete** next to the certificate.
## Use a certificate
After adding a client certificate, you don't have to perform any extra steps to use the certificate in Postman. When you make an HTTPS request to a specified domain, Postman automatically sends the client certificate with the request. The certificate is sent using OpenSSL handling, and Postman doesn't change the certificate.
Postman won't send the certificate if you make an HTTP request.
### Confirm a certificate was sent
You can confirm that a certificate was sent using the [Postman Console](/docs/sending-requests/response-data/troubleshooting-api-requests/). Open the Postman Console by selecting **Console** in the Postman footer, then send a request.
In the example below, Postman sent the certificate because the request used HTTPS. You can expand the request to view details about the certificate that was sent with the request.
### View certificate details
You can view more certificate details in the response pane. The 
**Network** icon includes a padlock if a request was sent using HTTPS. Hover over **Network** to view information about the certificate that was sent with the request, and any warnings or errors for self-signed or expired certificates.
### Troubleshoot certificate errors
If certificate verification fails when sending a request, Postman displays an error message in the response pane. To fix the error, turn off SSL verification for the request.
To turn off SSL verification for the request, do the following:
1. Open the request and select the **Settings** tab.
2. Set the **Enable SSL certificate verification** toggle to **OFF**.
3. Send the request again.
You can turn off SSL verification globally in [Postman settings](/docs/getting-started/installation/settings/) on the **General** tab.
If SSL verification is turned off, you can hover over 
**Network** in the response pane to get details about any certificate errors or warnings.
You can also find more information about certificate errors in the [Postman Console](/docs/sending-requests/response-data/troubleshooting-api-requests/).
