Unable to verify the first certificate, self-signed certificate not working?

[reallycantpickaname]

I have checked the following:

• I have searched existing issues and found nothing related to my issue.

This bug is:

• making Bruno unusable for me
• slowing me down but I'm able to continue working
• annoying
• this feature was working in a previous version but is broken in the current release.

Bruno version

2.6.1

Operating System

Windows 10

Describe the bug

I'm working on a .Net web application and would like to use (the awesome) Bruno to test my API, which runs on localhost via https.

My issue can be reproduced by creating a new ASP.NET Core Web Application with MVC, running the project, trusting the self-signed certificate (created via "dotnet dev-certs https --trust") then browsing to the default endpoint https://localhost:[port]/WeatherForecast.

The endpoint works fine with the self-signed certificate in the browser, and with curl, but with Bruno I receive "unable to verify the first certificate", and the Network Logs from the Timeline show:
Preparing request to https://localhost:7246/WeatherForecast
Current time is 2025-06-20T10:39:08.926Z
GET https://localhost:7246/WeatherForecast
Accept: application/json, text/plain, /
Content-Type: undefined
User-Agent: bruno-runtime/2.6.1
SSL validation: enabled
ALPN: offers h2, http/1.1
Using system default CA certificates
Trying localhost:7246...
DNS lookup: localhost -> 127.0.0.1
Connected to localhost (localhost) port 7246
Socket error: unable to verify the first certificate
there was an error executing the request!
{"code":"UNABLE_TO_VERIFY_LEAF_SIGNATURE"}
{"code":"UNABLE_TO_VERIFY_LEAF_SIGNATURE"}

I've tried exporting the self-signed certificate as a PEM file (e.g. "dotnet dev-certs https --export-path C:\path\to\localhost.pem" --format PEM --password YourStrongPassword --trust" etc.) and adding it to Bruno > Preferences > Use Custom CA Certificate, but the error remains.

I wonder if this is a node TLS trust issue etc., and would appreciate any help with getting this resolved so that I can test localhost https endpoints with Bruno.

Thanks for this excellent app.

.bru file to reproduce the bug

No response

Screenshots/Live demo link

JIRA

[anusree-bruno]

Is the SSL/TLS certificate verification enabled in preference? If so can you try disabling it?

[reallycantpickaname]

Hi @anusree-bruno, thanks for your assistance. Yes, SSL/TLS Certificate Validation was enabled when the issue occurred.

I should have mentioned that, yes, I can make requests successfully when SSL/TLS Certificate Validation is disabled however I need to use Bruno against production APIs too, so I need SSL/TLS Certificate Validation enabled for security (so that I can be sure the production credentials I'm submitting are encrypted).

With SSL/TLS Certificate Validation disabled and no Custom CA Certificate, the request succeeds and the Network Logs show SSL certificate verification succeeded against the dotnet self-signed (localhost) certificate:

With SSL/TLS Certificate Validation disabled and a Custom CA Certificate, the request succeeds and the Network Logs show SSL certificate verification succeeded against the dotnet self-signed (localhost) certificate:

Please feel free to suggest anything you'd like me to test, I'm reasonably technical.

[reallycantpickaname]

Hi @anusree-bruno , do you have any suggestions regarding how I might enabling SSL/TLS Certificate Validation and successfully connect to a localhost api via https?

[nozzrangar]

I'm having the same question. Would be good to know how or if this can be done

[aberamseyer]

Also have the same issue.

I'll add in that the equivalent cli command succeeds for me: bru run <request>.bru --env <my_env> --cacert <path_to_pem>. Looking at the code, it's probably a bug with how the https Agent is passed to axios. The code that the cli runner uses is separate and much simpler without all the wrapping with the timeline interceptor.

[Pragadesh44-Bruno]

Hey @reallycantpickaname, it looks like Node.js doesn't trust the system’s certificate trust store by default. I was able to reproduce the issue locally, and since Bruno uses Node under the hood, we're likely hitting the same limitation.

You can find more context here:

• Node uses an hardcoded list of certificate authorities nodejs/node#4175

To work around this, you’ll need to create a custom CA certificate and configure Bruno to trust it. One recommended approach is to use mkcert, which generates a local CA and valid development certificates that Node.js (and therefore Bruno) can trust.

[binoyp]

This was, in fact, a show stopper for me. I switched back to JetBrains.

[t-foerster]

@binoyp I ran into the same problem with Bruno 2.8, even when using mkcert for a local CA - but updating to the freshly released Bruno 2.8.1 fixed the issue for me. Now Bruno respects the checkbox for ignoring the TLS certificates again. Toggling on causes the expected error of not verifying the CA, toggling off lets me use my local API.

Am I correct to assume that Bruno uses their own CA store and does not check the default windows store? (Similar to how you gotta install the CA to Firefox while Chrome/Edge etc. use the windows store)?

Either way thank you so much for this amazing project and all the love you guys pour into Bruno!

[binoyp]

@t-foerster Thank you for the update. I will definitely try again.

[Dubai-Takodachi]

Also have the same issue.

I'll add in that the equivalent cli command succeeds for me: bru run <request>.bru --env <my_env> --cacert <path_to_pem>. Looking at the code, it's probably a bug with how the https Agent is passed to axios. The code that the cli runner uses is separate and much simpler without all the wrapping with the timeline interceptor.

Tried this aswell and it did not work. Getting the same error:

PASSWORD_GRANT: Error fetching OAuth2 token: unable to verify the first certificate
Failed to get OAuth2 token: unable to verify the first certificate

Using the Bruno GUI works fine. Is there any update on this issue?

[andersespedalen]

I have the same issue. Can't really disable certificate verification globally since I'm also testing production systems. So this is unfortunately stopping me from migrating from Postman to Bruno.

Could a solution be to make this checkbox something you can control with an environment variable?

[Gajdascz]

Hopefully this can get fixed. Bruno is by far the least intrusive and most promising option currently available.