79803060

Date: 2025-10-28 16:35:26
Score: 0.5
Natty:
Report link

The premise of this question is flawed. My assumption that there was some sort of out-of-the-box integration with the Windows certificate store (more accurately called a keystore) was incorrect. The reason that Postman was accepting my internal CA issued server certificates is that SSL validation is disabled in Postman by default.

As an aside, this is the wrong default. I know that's an opinion but it's an opinion kind of like 'you shouldn't run wit scissors' or 'you shouldn't smoke around flammable vapors' is an opinion. If you use Postman, you should change the setting for SSL certificate verification under General:

enter image description here

You can disable SSL validation for a specific call if you need to for debugging purposes:

enter image description here

It seems the 'closed' issue linked in the question (first one) was closed with the wrong status. It is not 'completed' but rather a duplicate of an open feature request.

There does not appear to be any support for using a native OS certificate store (keystore) in Postman at this time and I don't see anything suggesting it will be supported anytime soon. If you need to call mTLS secured enpoints with a non-exportable client key, you will need different or additional tooling.

Thanks to TylerH for setting me straight.

Reasons:
  • Blacklisted phrase (0.5): Thanks
  • Long answer (-1):
  • No code block (0.5):
  • Self-answer (0.5):
Posted by: JimmyJames