This collection shows how to use custom CA certificates and client certificates in Bruno against badssl.com test endpoints.
A Certificate Authority (CA) certificate is a trusted root (or intermediate) that Bruno uses to verify a server’s TLS certificate.
- Without the correct CA, Bruno cannot trust the server and the request fails with an SSL/TLS / self-signed / untrusted certificate error.
- Adding a custom CA tells Bruno: “also trust certificates signed by this authority.”
A client certificate proves your identity to the server (mutual TLS / mTLS).
- The server asks for a client cert during the TLS handshake.
- You provide a certificate file (often
.p12/.pfx) and usually a passphrase. - Bruno presents that cert when the request host matches the configured domain.
In Preferences → General, Bruno has SSL/TLS options (including custom CA and verification-related settings).
| Setting | Purpose |
|---|---|
| SSL/TLS verification | When enabled, Bruno validates the server certificate against known / custom CAs. When disabled, Bruno skips certificate verification (useful for quick local debugging, not recommended for production). |
| Custom CA Certificate | Upload a .pem / CA file so Bruno trusts servers signed by that CA (for example untrusted-root.badssl.com). |
Use verification on with a proper custom CA when possible. Turning verification off hides certificate problems instead of fixing trust.
| File | Used for |
|---|---|
certificates/badssl-untrusted-root.pem |
Custom CA for https://untrusted-root.badssl.com |
certificates/badssl.com-client.p12 |
Client certificate for https://client.badssl.com |
The
certificates/folder is ignored by Bruno’s collection bundling (opencollection.yml). Keep cert files local; do not commit secrets or private keys to shared remotes unless your team intentionally manages them.
URL: https://untrusted-root.badssl.com
This site uses a certificate signed by an untrusted root. With Bruno’s default CA store, the request fails (self-signed / untrusted certificate error).
- Open Bruno → Preferences → General.
- Enable Use Custom CA Certificate.
- Select
certificates/badssl-untrusted-root.pemfrom this collection. - Keep SSL/TLS Certificate Verification enabled so Bruno uses the custom CA to validate the server.
- Open the
ca-certrequest and send it.
Expected result: The request succeeds and you get a normal HTTPS response from badssl.
Without the custom CA: Sending the same request with only the default CA trust store fails with an SSL/TLS certificate error from badssl’s untrusted root.
URL: https://client.badssl.com
This endpoint requires a client certificate. Without it, the TLS handshake fails or the server rejects the connection.
| Field | Value |
|---|---|
| Host | client.badssl.com |
| Certificate file | certificates/badssl.com-client.p12 |
| Passphrase | badssl.com |
- Open this collection → Collection Settings → Client Certificates.
- Click + Add Certificate and set:
- Host:
client.badssl.com - Type: PFX / PKCS#12 (
.p12) - File:
badssl.com-client.p12 - Passphrase:
badssl.com
- Host:
- Save, then send the
client-cert-badsslrequest.
From Bruno v4.1.0, you can also add client certificates at the app (Preferences) level, not only on a single collection.
- Open Preferences → Client Certificates.
- Click + Add Certificate and set the same values:
- Host:
client.badssl.com - File:
badssl.com-client.p12 - Passphrase:
badssl.com
- Host:
- Save, then send the
client-cert-badsslrequest from any collection that targets that host.
Expected result: The request completes successfully against https://client.badssl.com.
Without the client cert: The request fails because the server requires mutual TLS authentication.
- Custom CA (
badssl-untrusted-root.pem) added in Preferences forca-cert - SSL/TLS verification left on when testing custom CA trust
- Client cert (
badssl.com-client.p12) added for hostclient.badssl.com(collection or app level) - Passphrase set to
badssl.com - Send
ca-certandclient-cert-badsslindividually to verify both flows