Your own root certificate (CA)
Point the Outpost at an internal root certificate when your network inspects TLS.
Many corporate networks inspect outbound HTTPS: a firewall or web proxy decrypts the connection and re-encrypts it with its own root certificate. To the Outpost this looks like a foreign certificate on bridge.meingpt.com — and it aborts, which is exactly what it should do.
To let it work anyway, you show it your root certificate.
How you know this is the problem
The Connection tab and the wizard share the same button: Run check. The TLS certificate check then fails and names the issuer — for the common appliances, by name, e.g. Zscaler Root CA. That is the unambiguous diagnosis; without it, a failed pairing is just as often a firewall rule or a proxy.
Check first, configure second
Adding a custom certificate because pairing does not work is guessing. Run the check: it tells you whether DNS, TCP, TLS, reaching meinGPT or the system clock is the problem.
Setting it up
Get the certificate
Ask IT for the root CA certificate in PEM or CRT format. It looks like this:
-----BEGIN CERTIFICATE-----
MIIFuTCCA6GgAwIBAgIU...
-----END CERTIFICATE-----
Put the file on the Outpost machine, somewhere permanent — not in the downloads folder. It is read on every start.
If the chain consists of a root plus intermediates, concatenate them into one file (root first).
Select it in the Outpost
Connection tab → Custom certificate card → Choose…. The operating system's file dialog opens; pick the .pem or .crt file.
The Active certificate row then shows the path instead of OS store (default). That is the confirmation that it landed.
Run the check again
Run check. If TLS certificate passes, you are done; pairing works afterwards.
If the check stays red, the chain is usually incomplete — ask IT for the intermediates and append them to the same file.
What the Outpost does with it
The certificate applies to all outbound connections of the Outpost: the tunnel to meinGPT, the meinGPT API, and your own embedding endpoint if you use one. It does not replace the operating system's certificate store, it is added to it — publicly trusted certificates stay valid.
With nothing configured, the Outpost uses the operating system's store. If your root certificate is rolled out there by group policy anyway, you do not need this page.
Limits
- One file, not a directory. Combine multiple CAs into one bundle file.
- The path has to stay. If the file is moved or deleted, the Outpost falls back to the OS store on the next start and the check fails again. The Connection tab then shows OS store (default) once more.
- This is not a client certificate. If your proxy requires client-certificate authentication, that is a different case — talk to us (enterprise@meingpt.com).