> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/infrastructure-as-code-management/platform/iacm-connectors-variables/iacm-plugins/plugin-ca-cert-path.md).

# PLUGIN\_CA\_CERT\_PATH

Configure PLUGIN\_CA\_CERT\_PATH to trust a corporate CA certificate for provisioner binary downloads behind a TLS-intercepting proxy.

Points the IaCM plugin to a corporate CA certificate so it can trust a TLS-intercepting proxy during provisioner binary downloads. A corporate CA certificate is your organization's internal certificate authority certificate. Corporate proxies commonly use this certificate to re-sign intercepted HTTPS traffic, which causes standard certificate validation to fail unless the plugin explicitly trusts it.

**Applies to:** Terraform, OpenTofu, Terragrunt, and AWS CDK.

**When to use it:** Use this variable when IaCM runs on customer-managed infrastructure behind an HTTP(S) forward proxy that re-signs TLS certificates with a corporate CA. If provisioner downloads fail or hang while calls to `*.harness.io` succeed, configure `PLUGIN_CA_CERT_PATH`.

***

## Requirements <a href="#requirements" id="requirements"></a>

* The value must point to a single PEM file containing one or more certificates (a CA bundle), not a directory.
* Mount the certificate file into the runner or plugin container before referencing it.

**How it works:** When set, the plugin creates a trust bundle that combines your corporate CA certificate with the operating system's default trusted root certificates and configures the provisioner download process to use this bundle automatically. The plugin also sets `SSL_CERT_FILE`, `CURL_CA_BUNDLE`, and `SSL_CERT_DIR` for troubleshooting. You do not need to configure these variables manually.

***

## Configure PLUGIN\_CA\_CERT\_PATH <a href="#configure-plugincacertpath" id="configure-plugincacertpath"></a>

1. Mount your corporate CA certificate into the runner or plugin container. For example:

   ```
   /etc/iacm/corporate-ca.pem
   ```
2. Add a workspace environment variable with:
   * **Key:** `PLUGIN_CA_CERT_PATH`
   * **Value:** The mounted certificate path.
3. Re-run the pipeline.

**Verify:** Check the step logs for a message similar to:

```
[certs] corporate CA trust configured from /etc/iacm/corporate-ca.pem
```

The **Installing provisioner** step downloads the provisioner binary successfully through the proxy, and the pipeline continues with the remaining IaCM operations.

***

## Next steps <a href="#next-steps" id="next-steps"></a>

* Go to [IaCM plugins](/infrastructure-as-code-management/platform/iacm-connectors-variables/iacm-plugins.md) for the full list of plugin environment variables.
* Go to [Custom images for OpenTofu](/infrastructure-as-code-management/use-iacm/iac-provisioners/opentofu/custom-images.md) to add certificates by building a custom plugin image.

{% @harness-feedback/feedback %}