Does Trello support self-signed certificates for webhook endpoints?
0 reputation · 30 May 2020, 15:00 UTC
Trello webhook callback URLs must use HTTPS, and the documented behavior indicates that the endpoint must present a TLS certificate signed by a publicly trusted certificate authority. Local development with tunneling services often works because those services supply valid certificates, but the same code can fail when deployed to a production server using a self-signed or internally issued certificate.
The unresolved point is whether Trello provides any configuration, header, or account-level setting that relaxes certificate verification for webhook delivery. The documentation does not describe a mechanism to trust an internal PKI, and failures in this scenario tend to appear as silent event loss rather than an obvious registration error.
Assuming the current Trello webhook API, can a production endpoint with a self-signed certificate ever receive webhook events without replacing the certificate? Which part of the Trello webhook lifecycle enforces the public CA requirement—registration, delivery, or both? Is there a supported alternative for organizations that cannot obtain a publicly trusted certificate for the callback host?