Nitro proxy SSL and CA certificate validation during SSR fetch

When using Nuxt 3 with the Nitro engine, server-side requests initiated via useFetch rely on the Node.js runtime for certificate validation rather than the client's browser. While client-side requests utilize standard trust stores, the SSR process often fails when targeting internal APIs protected by private CAs.

There is currently uncertainty regarding how to consistently inject custom CA bundles into the Nitro server-side fetch logic through the nuxt.config.ts without utilizing global environment variables like NODE_TLS_REJECT_UNAUTHORIZED. Relying on global flags is problematic for production environments as it affects the security posture of the entire process.

What is the recommended approach to pass specific CA certificates to the Nitro engine for server-side proxy requests? Is there a native configuration option in Nuxt to define custom SSL agents specifically for proxied routes while maintaining strict certificate validation?