> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corvic.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# TLS Certificates

> Trust your own certificate authority, or present a client certificate for mutual TLS.

Database (Oracle), API key, MCP, OAuth, and cloud storage connectors have an optional **TLS certificates** section for servers that need more than the usual public certificates. Both settings apply only to that connector's own servers.

## Trusted CAs

If a server's certificate comes from your own certificate authority, or is self-signed, Corvic can't verify it by default and the connection fails (for Oracle, with ORA-29024). Paste or upload the CA certificate, in PEM, under **Trusted CAs**. Corvic still trusts the usual public roots as well. The connector shows each CA's name and expiry, and warns before one expires.

For a database reached over [Corvic Private Networking](https://docs.corvic.ai/virtual-network/private-networking.md), add that CA here when the listener certificate is not publicly trusted.

## Client certificate

If a server asks clients to present a certificate (mutual TLS), add it under **Client certificate** and **Private key**, in PEM: your certificate first, then any intermediates, and an unencrypted private key. Corvic presents it only to this connector's servers and never gives it to agents. Once saved, the connector shows the certificate's subject, issuer, and expiry, never the key. A `.p12` or `.pfx` file, or an encrypted key, isn't accepted yet: convert it to PEM first.

> [!NOTE]
>
> Two connectors used in the same run can't both bring their own CAs or client certificates for the same server. Corvic refuses such a run rather than guess which connector's certificates apply.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.