Does Harbor support per-endpoint certificate trust for webhook notifications?

When Harbor must deliver webhook notifications to an HTTPS endpoint signed by a private CA, the goal is to keep certificate validation enabled without trusting that CA across every outbound connection. The uncertainty is that Harbor's core and jobservice containers use their own operating system trust store, so a private CA installed on the production host is not automatically available to those containers. Replication endpoints expose a per-endpoint Verify Cert option, but webhook notifications do not appear to offer an equivalent per-endpoint toggle, leaving administrators to choose between injecting the CA into the container trust store or accepting insecure delivery.

The supported injection method also differs by deployment path: the Helm chart and the offline or online installers use distinct volume mount locations for custom CA certificates, and manual trust store edits may not persist across upgrades. Because local Harbor instances often run with HTTP or self-signed certificates, this trust gap may not surface until the first production webhook fires. Behavior can vary between Harbor versions, so the applicable chart values or harbor.yml settings should be confirmed for the deployed release.

Does Harbor provide a documented way to scope private CA trust to individual webhook endpoints, or is system-wide trust store injection the only supported option? Which deployment artifacts—Helm values versus installer configuration—control the CA mount paths for webhook delivery in current Harbor releases? What verification steps can confirm that the jobservice container recognizes the private CA before enabling production webhook traffic?