[Docs/Feature] Builder container needs documented support for private/internal certificate authorities
Author: DW-MediaLabCreated Sep 12, 2026Updated Sep 12, 2026
Summary
When self-hosting Webstudio with an internal HTTPS reverse proxy using a private CA, the browser can trust the CA while the Webstudio builder container itself does not.
This caused project previews to fail with:
400: fetch failedTesting from inside the builder container showed the real problem:
certificate verify failed
ssl_client: SSL_connect
wget: error getting response: Connection reset by peerThe working solution was to mount the internal CA certificate into the builder container and configure Node:
environment:
NODE_EXTRA_CA_CERTS: /certs/caddy-root.crt
volumes:
- /path/to/caddy-root.crt:/certs/caddy-root.crt:roAfter this, canvas previews started working immediately.
Suggested change
Document NODE_EXTRA_CA_CERTS for on-premises/private-PKI installations.
An optional compose variable/mount convention for a custom CA bundle would make this substantially easier to deploy.
Source: webstudio-is/webstudio