Diagnosing and Resolving Postman SSL Self-Signed Certificate Errors

You point Postman at a local HTTPS endpoint and the request fails instantly with SSL Error: Self Signed Certificate or a generic Could not get any response. The API never receives the call. This guide helps you confirm the cause, apply the narrowest safe fix, and recognize when the problem belongs to someone else.

Recognizable Condition

The failure is immediate—not a timeout—and appears in the response pane before any HTTP status code is returned. It commonly targets localhost, 127.0.0.1, internal dev domains, or staging hosts that use certificates generated by a local tool or an internal certificate authority (CA) rather than a public root CA. A browser may load the same URL after you click through a warning, but Postman rejects the connection by design.

Cause and Diagnostic Table

Observation	Likely Cause	Next Check
SSL Error: Self Signed Certificate in response pane	Server presents a certificate signed by a CA that Postman does not trust	Inspect certificate chain with openssl
Could not get any response with no HTTP status	TLS handshake aborted before any HTTP data was exchanged	Open Postman Console and look for handshake failure
Browser works after clicking through a warning	Browser trusts the certificate temporarily; Postman does not	Compare trust stores; confirm server cert details
Same error on multiple unrelated hosts	SSL verification is disabled globally or a proxy is intercepting TLS	Review Postman SSL settings and network proxy config

Ordered Checks

1. Capture the exact TLS failure. Open the Postman Console (Ctrl+Alt+C on Windows/Linux, Cmd+Option+C on macOS) and resend the request. Look for a TLS handshake error or a message mentioning a self-signed certificate. This confirms the failure occurs during the TLS handshake—the cryptographic negotiation that happens before HTTP—rather than at the DNS or network layer.
2. Verify the server certificate independently. From a terminal (macOS, Linux, or Windows with OpenSSL installed), run:
   

   openssl s_client -connect api.local:443 -servername api.local < /dev/null

   Replace api.local with your target hostname and 443 with the correct port. In the output, look for a line such as Verify return code: 19 (self-signed certificate in certificate chain) or Verify return code: 18 (self signed certificate). If you see this, the server is using a certificate that is not anchored to a publicly trusted root CA.
3. Check Postman's verification setting. In Postman, open the application settings and locate the SSL certificate verification toggle. In many versions this appears under Settings > General (or Preferences > General on macOS) as SSL certificate verification. If it is ON, Postman is behaving correctly by rejecting the untrusted certificate.

Fixes Tied to Findings

If the server is local and you control it

The narrowest fix is to make Postman trust the specific certificate authority that signed the server certificate, rather than turning off verification entirely. Export the CA certificate (usually a .crt or .pem file) and add it to Postman's certificate store. In recent Postman versions this is managed under Settings > Certificates, where you can add CA certificates or configure client certificates. This keeps TLS verification active for every other request.

If you cannot locate the CA file but you control the server, regenerate the certificate with a locally trusted root and distribute that root to Postman. Tools such as mkcert create a local root CA and install it into the system trust store; you then export that root and add it to Postman.

If you must disable verification temporarily

For an isolated local environment, you can toggle SSL certificate verification to OFF in Postman settings. This allows the request to complete, but it also disables certificate validation for all subsequent requests in that Postman instance. On an untrusted network, this exposes you to man-in-the-middle (MitM) attacks, where an attacker intercepts traffic between Postman and the server. Never use this setting against production APIs or shared staging environments.

If the certificate comes from an internal corporate CA

Do not disable verification. Obtain the internal root or intermediate CA certificate in PEM format from your platform or security team and add it to Postman's CA certificate list. If your organization uses a custom proxy that re-signs TLS traffic, you may also need to add the proxy's CA certificate so Postman trusts the re-signed chain.

Escalation Criteria

• The host is shared staging or production. Disabling verification is not an acceptable fix. Escalate to the team that manages the server certificate and request a certificate from a publicly trusted CA or a properly distributed internal CA.
• OpenSSL reports an expired certificate or hostname mismatch. This is a server-side configuration error, not a self-signed certificate issue. Provide the openssl output to the server administrator.
• Adding the CA certificate does not resolve the error. The chain may be incomplete, the key type may be unsupported, or Postman may be using a different trust store than expected. Escalate with the Postman Console log and the openssl s_client output attached.
• The error appears only behind a corporate VPN or proxy. The proxy may be intercepting TLS. Contact your network or platform team before changing Postman settings.

Limitations and Verification

Disabling SSL verification is a global application setting in most Postman versions; it does not automatically scope to a single request or collection unless you use collection-level or environment-specific configuration. After applying a fix, resend the request and check two things: the response pane returns a normal HTTP status instead of the SSL error, and the Postman Console no longer logs a TLS handshake failure for that host. If you added a CA certificate, confirm that other requests to public HTTPS APIs still succeed, proving that verification remains enabled for trusted hosts.

Exact menu labels and toggle locations can shift between Postman versions. If you do not see SSL certificate verification under General settings, check the Certificates tab or the application preferences for your platform.