Reference
TLS
Terminate TLS in front of the control plane, and trust a private CA.
Terminating TLS
The control plane serves plain HTTP. Terminate TLS at the load balancer in front of port 6420.
Trusting a private CA
For outbound HTTPS, such as to the bucket, the control plane trusts the operating system’s certificate store. To trust a private CA inside the image, extend it:
FROM rivetdev/engine:2.3.31
COPY my-corp-ca.crt /usr/local/share/ca-certificates/
RUN update-ca-certificates