# Identity-sync private CA bundles

Identity-sync clients always verify the server certificate and hostname.
Private/on-prem vendors must be trusted with an approved CA bundle; do not use
`verify_ssl=false`.

Production mounts `/opt/helix/ca-certificates` from the host read-only at
`/etc/helix/ca-certificates` in both the backend and worker containers. Install
only public CA certificates (never client private keys) as root-owned `.pem` or
`.crt` files. Each vendor file must contain the complete issuing chain needed
to validate the server: all issuing intermediate CA certificates plus the root
CA, in PEM format. Do not put the server leaf certificate or any private key in
this bundle. For example:

```bash
cat vendor-intermediate.pem vendor-root.pem > vendor-chain.pem
sudo install -o root -g root -m 0644 vendor-chain.pem \
  /opt/helix/ca-certificates/vendor-chain.pem
```

Set the integration's **Approved CA Bundle Path** to the container path, for
example `/etc/helix/ca-certificates/vendor-chain.pem`, then run **Test
Connection**. Restart backend and worker after changing a file in place so all
long-lived clients rebuild their SSL contexts:

```bash
cd /opt/helix/compose
sudo docker compose -f docker-compose.prod.yml restart backend worker
```

The save and runtime paths both require an existing regular `.pem`/`.crt` file
under the approved mount and build a `CERT_REQUIRED` context with hostname
checking enabled. Symlinks resolving outside the mount, relative paths,
directories, unreadable files, and malformed bundles fail closed.

For SCIM/Navan and NetSuite, an integration-level CA path takes precedence over
the legacy target `runner_options.ca_bundle_path`. Move legacy target values to
the integration when convenient; they remain supported for migration
compatibility.