SSL certificate validation in Postman

Introduction

SSL certificate validation ensures the website or API you connect to is secure and trustworthy. It helps protect your data from being stolen or tampered with.

When testing APIs that require secure HTTPS connections.

When verifying that your app connects only to trusted servers.

When debugging connection errors related to security certificates.

When ensuring compliance with security standards in your tests.

Syntax

Postman

In Postman settings:
- Go to Settings > General
- Toggle 'SSL certificate verification' ON or OFF

Turning SSL certificate verification OFF allows connections to servers with invalid or self-signed certificates.

Keep SSL certificate verification ON for real security testing.

Examples

These settings control whether Postman checks the SSL certificate of the server before sending the request.

Postman

1. SSL certificate verification ON (default)
- Postman blocks requests to servers with invalid SSL certificates.

2. SSL certificate verification OFF
- Postman allows requests even if SSL certificates are invalid or self-signed.

Sample Program

This test script checks if SSL certificate validation is enabled in Postman settings. It passes if SSL verification is ON.

Postman

// Postman test script example to check SSL certificate validation status
pm.test('SSL certificate validation is enabled', () => {
    const sslVerification = pm.settings.get('sslVerification');
    pm.expect(sslVerification).to.be.true;
});

Important Notes

Disabling SSL certificate validation is useful for testing in development but risky in production.

Always verify SSL certificates when testing APIs that handle sensitive data.

Summary

SSL certificate validation protects your data by ensuring secure connections.

Postman lets you turn SSL certificate validation ON or OFF in settings.

Keep SSL validation ON for real security testing and OFF only for special cases.