Terramate TLS handshake fails with self‑signed certificates on remote backend

When Terramate executes commands that contact a remote backend or Terramate Cloud endpoint presenting a self‑signed or privately issued TLS certificate, the connection aborts with an x509: certificate signed by unknown authority error.

The only way to make the TLS handshake succeed is to add the certificate authority to the operating system's trust store or to set environment variables such as SSL_CERT_FILE or GODEBUG, which affects all processes on the host and may conflict with security policies.

Terramate does not expose a dedicated configuration option in terramate.config to supply a custom CA file or to skip verification, and the feature request for a TLS configuration block remains open.

What mechanisms could Terramate provide to allow per‑project custom CA configuration without altering the host trust store? Is there a timeline for implementing a TLS configuration block in terramate.config? Are there recommended secure work‑arounds that avoid disabling verification entirely?