Postman includes a global setting to disable SSL certificate verification (under Settings → General → "SSL certificate verification"), which is sometimes used to work around certificate errors while testing against a development or staging environment with a self-signed or otherwise imperfect certificate.
Using this responsibly
Disabling verification entirely is a reasonable, deliberate choice for testing against a known development environment — it's not an appropriate permanent fix for a production API you're integrating with. If you're hitting certificate errors against a production endpoint, the correct fix is resolving the actual certificate issue on that server, not disabling Postman's verification globally and leaving it that way.
What Postman's SSL certificate verification setting controls
Postman includes a global setting to disable SSL certificate verification, primarily intended for testing against known self-signed or internal development certificates — this setting should be used cautiously and only for genuinely trusted internal testing scenarios, never as a routine way to bypass a legitimate certificate warning.
How to add a custom CA certificate to Postman for internal API testing
Postman's settings include a CA Certificates section where you can add a specific certificate file for Postman to trust, letting you properly test against an internal API secured with a private CA without needing to globally disable certificate verification for all requests.
What Postman's client certificate settings are for versus the general SSL verification toggle
Distinct from the general SSL verification setting, Postman also supports configuring client certificates for requests to servers requiring mutual TLS — a separate settings section from the CA trust configuration, worth knowing about if you're testing against an mTLS-secured API.
How to test the same request outside Postman to confirm whether the issue is Postman-specific
Running the identical request with command-line curl, using the same URL and headers, isolates whether an SSL error is specific to Postman's own certificate handling and settings, or reflects a genuine, tool-independent server-side certificate issue.
A final note on team documentation
For a team sharing Postman collections and environments, documenting any required custom CA certificate configuration as part of your onboarding materials ensures new team members can successfully test against internal APIs without needing to rediscover the correct setup independently.
What the exact steps look like for adding a CA certificate in Postman's settings
Navigating to Settings → Certificates → CA Certificates in Postman and adding your specific certificate file lets Postman trust that CA specifically for future requests, a more targeted and safer approach than the global SSL verification toggle, which disables verification entirely for every request.
How team-shared Postman workspaces should handle this configuration consistently
For a team sharing Postman workspaces, documenting the specific CA certificates needed for internal API testing in your team's onboarding materials, rather than expecting each member to discover the correct configuration independently, ensures consistent, working setup across your entire team.
A quick closing checklist
A quick closing checklist covers adding a specific CA certificate through Postman's dedicated settings rather than disabling verification globally, testing the same request with curl for comparison, and documenting your team's specific internal CA setup for consistent onboarding.
How Postman's Interceptor and desktop app can behave differently for certificate handling
Postman's browser extension-based Interceptor mode and its standalone desktop application can have subtly different certificate handling behavior — if you're troubleshooting inconsistent results, confirming which specific mode or version you're using helps explain unexpected discrepancies.