> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/aikido-device-protection/miscellaneous-aikido-endpoint/custom-ca-certificates.md).

# Adding a Custom CA Certificate

To inspect package manager traffic, Device Protection uses a local Certificate Authority (CA) and builds CA bundles for the tools it configures at install. Those tools are pointed at Aikido's bundle instead of their own default trust list, so any CA that isn't in the bundle is no longer trusted by them.

That matters if your organization runs its own CA, for example a corporate proxy that inspects TLS traffic (Zscaler, Netskope) or a private registry served with an internal certificate. Adopting your CA adds it to every bundle Aikido builds, and keeps it there whenever Aikido rebuilds or repairs those bundles.

## When you need this

Adopt a CA when, after Device Protection is installed, your tools fail to reach an internal host or a registry behind TLS inspection. The errors typically mention a self-signed certificate, an unknown or untrusted issuer, or a certificate that could not be verified.

If the failing certificate is Aikido's own CA rather than your organization's, see [Fixing SSL/TLS Certificate Errors](/aikido-device-protection/miscellaneous-aikido-endpoint/ssl-certificate-errors.md) instead.

## Before you start

* Your CA certificate as a PEM file on the device, for example `corporate-ca.pem`.
* Administrator access. The command must run as root on macOS and Linux, or from an elevated prompt on Windows.

## Adopt the CA

{% tabs %}
{% tab title="macOS / Linux" %}

```bash
sudo aikido-doctor certconfig adopt /path/to/corporate-ca.pem
```

{% endtab %}

{% tab title="Windows" %}
Run from an elevated Command Prompt or PowerShell:

```
aikido-doctor.exe certconfig adopt C:\path\to\corporate-ca.pem
```

{% endtab %}
{% endtabs %}

Aikido adds the CA to the bundles it builds and reinstalls the trust configuration for each tool.

{% hint style="info" %}
Shells and services that were already running keep their old environment. Open a new login shell before you test, or restart the affected service.
{% endhint %}

## What adopting does and doesn't change

* It covers every CA bundle Aikido builds. See [Fixing SSL/TLS Certificate Errors](/aikido-device-protection/miscellaneous-aikido-endpoint/ssl-certificate-errors.md) for the tools Device Protection configures at install.
* The CA survives Aikido's automatic drift repair, so it stays trusted when a rule is reinstalled.
* It does not change the macOS System Keychain or the Windows Certificate Store. Tools that read the operating system trust store keep using whatever your MDM installed there.
* It does not register a registry domain for inspection. To have Device Protection scan packages coming from your own registry, add it under [Custom Registries](/aikido-device-protection/using-aikido-endpoint/custom-registries.md).

## Related pages

{% content-ref url="/pages/aqSzOzkyVOAcDF4MxAnb" %}
[Fixing SSL/TLS Certificate Errors](/aikido-device-protection/miscellaneous-aikido-endpoint/ssl-certificate-errors.md)
{% endcontent-ref %}

{% content-ref url="/pages/SX97JzGzckPTP5JW5ETb" %}
[The aikido-doctor CLI](/aikido-device-protection/miscellaneous-aikido-endpoint/aikido-doctor-cli.md)
{% endcontent-ref %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.aikido.dev/aikido-device-protection/miscellaneous-aikido-endpoint/custom-ca-certificates.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.