Trusted certificates
One trust store for every outbound TLS connection: the host’s roots, the built-in DoD PKI roots, mounted ConfigMaps and files, and certificates uploaded in the app.
What it covers
Every outbound TLS connection Janus makes verifies against one trust store: AI providers and model discovery, identity providers (OIDC), LDAP, S3 object storage, alert webhooks and SMTP, OTLP, personal-subscription vendors. Public web pages read by deep research verify against the host’s roots only.
Changes apply to new connections within seconds, on every replica, without a restart. Revocation checking (JANUS_TLS_REVOCATION) applies on top.
Sources
The host’s system roots (the image’s CA bundle).
DoD PKI root CAs 3–6, built in and refreshed each release from DISA’s signed PKI/PKE bundle. On by default in the Janus FIPS edition, off otherwise; set JANUS_TRUST_DOD_ROOTS=true or false to choose. Intermediate CAs are not built in: servers send them.
A directory of PEM certificates: point JANUS_CA_DIR at any directory of .pem, .crt or .cer files (on Kubernetes, a mounted ConfigMap or Secret), or JANUS_CA_BUNDLE at one PEM file. The directory is rescanned every 30 seconds, so an edited ConfigMap applies without a restart.
In the app: Administration → Settings → Certificates → Add certificate. Paste a PEM certificate or chain, or choose a file. A private key is refused, and so is an expired certificate. Uploads are stored in the database, shared by every replica, and audited (trusted_certificate_added / trusted_certificate_removed).
Mounted and built-in certificates are listed read-only (“Managed by the deployment”); change them in the deployment.
extraEnv:
JANUS_TRUST_DOD_ROOTS: "true" # unset: on for the FIPS edition image
JANUS_CA_DIR: /etc/janus/ca # mount your PEM certificates hereExpiry
Certificates within 30 days of expiry are flagged on the Certificates page and the System status Cryptography card, and administrators get one alert when a certificate enters that window and another when it expires. The built-in DoD roots are refreshed by releases and not alerted on.
Allow untrusted certificate
An upstream can be set to Allow untrusted certificate (edit the upstream). Janus then skips certificate verification for that upstream’s host only; every other connection is still verified. It applies to https:// upstreams and is audited (upstream_untrusted_tls_changed). Prefer adding the upstream’s CA instead.
The Janus FIPS edition and the STIG profile refuse the setting when saved, ignore a saved one when connecting, and the STIG profile refuses to start while an upstream has it on.