#6371·webstudio

[Docs/Feature] Builder container needs documented support for private/internal certificate authorities

Author: DW-MediaLabCreated Sep 12, 2026Updated Sep 12, 2026

Summary

When self-hosting Webstudio with an internal HTTPS reverse proxy using a private CA, the browser can trust the CA while the Webstudio builder container itself does not.

This caused project previews to fail with:

400: fetch failed

Testing from inside the builder container showed the real problem:

certificate verify failed
ssl_client: SSL_connect
wget: error getting response: Connection reset by peer

The working solution was to mount the internal CA certificate into the builder container and configure Node:

yaml
environment:
  NODE_EXTRA_CA_CERTS: /certs/caddy-root.crt

volumes:
  - /path/to/caddy-root.crt:/certs/caddy-root.crt:ro

After this, canvas previews started working immediately.

Suggested change

Document NODE_EXTRA_CA_CERTS for on-premises/private-PKI installations.

An optional compose variable/mount convention for a custom CA bundle would make this substantially easier to deploy.