Does Harbor support per-endpoint certificate trust for webhook notifications?

Direct Answer

No. Harbor does not provide a documented way to scope private CA trust to individual webhook endpoints. Webhook TLS validation uses the trust store inside the core and jobservice containers, so a private CA must be trusted system-wide for those containers. System-wide trust store injection is the only supported option.

Likely Explanation vs. Confirmed Behavior

The confusion usually starts with replication endpoints, which expose a per-endpoint Verify Cert option. That behavior does not extend to webhooks. Some Harbor versions may offer an insecure or skip-verify style option for webhook targets, but that disables certificate validation entirely for that endpoint; it is not equivalent to uploading a CA bundle for only that webhook. Treat any such toggle as unsuitable for production.

Because core and jobservice run as separate containers, a CA installed on the production host is not visible to them. Manual edits inside a running container are also lost on upgrade or pod recreation.

Steps for This Case

Inject the private CA into the container trust store. The controlling artifact depends on your deployment path.

Helm Deployments

Mount the CA certificate into the core and jobservice pods using the chart's volume or secret configuration. Run a Helm upgrade so the pods are recreated with the new mount, then confirm the CA appears in the pod spec.

Installer Deployments

Use the installer bundle and harbor.yml as the source of truth. Re-run the documented CA injection or installer flow rather than editing generated compose files directly. This ensures the CA lands in the correct trust store path for the deployed release.

Verification Before Production Traffic

1. Exec into the jobservice container and validate the webhook host against the mounted CA:

   openssl s_client -connect WEBHOOK_HOST:443 -servername WEBHOOK_HOST -CAfile /path/to/ca.crt -verify_return_error

   Require Verify return code: 0.
2. Confirm the CA is in the effective trust store:

   openssl version -d
   ls "$(openssl version -d | cut -d'"' -f2)/certs" | grep "$(openssl x509 -in /path/to/ca.crt -noout -hash)"

3. Isolate network problems from trust problems:

   curl --cacert /path/to/ca.crt https://WEBHOOK_HOST/health

4. Trigger a Harbor test webhook or controlled event and inspect jobservice logs for TLS errors such as x509: certificate signed by unknown authority.

If you tell me whether you deployed via Helm or the installer—and which Harbor version—I can narrow the exact chart values or harbor.yml keys for that release.