> For the complete documentation index, see [llms.txt](https://docs.platform9.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.platform9.com/private-cloud-director/2026.4/images-and-image-library/image-library-certificate-configuration.md).
# Image Library Service Certificate Configuration
## Overview
The Image Library Service uses a TLS certificate to secure image upload and retrieval traffic. If your browser or CLI client does not trust that certificate, image uploads from the UI will be blocked, and CLI uploads without the `--insecure` flag will fail.
space.vars.product\_name supports two deployment models with different certificate management paths:
* **SaaS** — Platform9 operates the management plane. The Image Library Service endpoint certificate is managed by Platform9. You accept the certificate in your browser; you do not modify management-plane certificates directly.
* **Self-Hosted** — You operate the management plane on-premise. You can supply your own custom certificate and apply it using `airctl`.
In this guide, you will trust or configure the Image Library Service certificate for your deployment model so that image uploads and VM provisioning succeed.
If you use Google Chrome, your browser may also prompt you to grant Local Network Access before the Image Library Service is reachable from the UI; see [Local Network Access in Chrome](#local-network-access-in-chrome) below.
## SaaS Deployments
In SaaS deployments, the Image Library Service host uses a self-signed certificate for the image upload endpoint. You must accept this certificate in your browser before you can upload images through the UI.
### Accept the Certificate in Your Browser
1. Sign in to the space.vars.product\_name UI.
2. Navigate to **Images**. If the certificate has not been trusted, a banner or notification appears that reads **Action Required: Trust Certificate**.
3. Click the link in the notification. A new browser tab opens to the Image Library Service endpoint.
4. In the browser's security warning page, expand **Advanced** (or **Details**, depending on your browser) and click the link to proceed to the site.
5. After accepting the certificate, close the tab and return to the **Images** page. The upload controls should now be active.
For detailed steps for each browser, see [Accept Certificate Authority](/private-cloud-director/2026.4/getting-started/accept-certificate-authority.md).
{% hint style="info" %}
**Certificate acceptance is per browser and per machine**
Each browser on each machine must accept the certificate separately. If a team member on a different workstation reports upload issues after you have already accepted the certificate, they must repeat these steps in their own browser.
{% endhint %}
### CLI Uploads (SaaS)
When using the `pcdctl` CLI to upload images in a SaaS deployment, include the `--insecure` flag to bypass certificate verification for the Image Library endpoint:
```bash
pcdctl image create --insecure --container-format bare --disk-format qcow2 \
--file
```
This flag applies to the image endpoint only. It does not affect Identity Service authentication.
### Management-Plane Certificate Changes (SaaS)
{% hint style="warning" %}
**SaaS deployments only**
In SaaS deployments, Platform9 manages the management-plane certificates. You cannot modify these certificates directly. If you need a custom or CA-signed certificate for the Image Library Service endpoint in a SaaS deployment, contact [Platform9 Support](https://support.platform9.com/).
{% endhint %}
## Self-Hosted Deployments
In Self-Hosted deployments, you have full control over management-plane certificates and can supply a custom certificate.
### Accept the Default Self-Signed Certificate
If you are using the default self-signed certificate generated during installation, follow the same browser-acceptance steps as for SaaS deployments (see above). This is the quickest path for small or evaluation deployments.
For CLI uploads, use the `--insecure` flag with `pcdctl image create` as shown in the SaaS section above.
### Configure a Custom Certificate
{% hint style="info" %}
**Self-Hosted deployments only**
The steps in this section apply only to Self-Hosted space.vars.self\_hosted\_product\_name. In SaaS deployments, contact Platform9 Support for certificate changes.
{% endhint %}
To replace the default self-signed certificate with a CA-signed or custom certificate, use the `airctl renew-certs` command. This updates the management-plane certificate, which is then used by the Image Library Service and other services.
For full instructions, see [Using Custom Certificates](/private-cloud-director/2026.4/getting-started/self-hosted/using-custom-certificates.md).
After applying a new certificate, verify that the Image Library Service endpoint is reachable:
```bash
curl -s https://:9292/
```
If you configured a CA-signed certificate, this request should succeed without the `-k` flag. If it returns a certificate error, confirm that the certificate's Subject Alternative Names (SANs) include the Image Library host's FQDN or IP address.
### Verify Certificate Trust After Changes
After updating certificates in a Self-Hosted deployment, restart the Image Library Service on the affected host:
```bash
sudo systemctl restart pf9-glance-api
```
Then re-check the endpoint health and attempt a test upload to confirm the change took effect.
## Local Network Access in Chrome
{% hint style="info" %}
**Experimental Chrome feature**
Local Network Access is an experimental Google Chrome feature and may not be enabled for every user. If your browser prompts you for it, follow the steps below; if it does not, no action is needed. See the [Chrome Local Network Access blog post](https://developer.chrome.com/blog/local-network-access) for background.
{% endhint %}
The Image Library Service endpoint is reached over a private IP address on your network, for example `https://:9494`. Some versions of Chrome ask for an additional, one-time permission before a website can reach a host on your local network. If your browser prompts you for Local Network Access, you must grant it before the space.vars.product\_acronym UI can reach the Image Library Service, even after you have already trusted its certificate.
### When the Prompt Appears
Chrome shows the Local Network Access prompt the first time the space.vars.product\_acronym UI tries to reach the Image Library Service host, for example when you open the **Add Image** form or start an image upload. Select **Allow** to grant access.
### Action Required in the Add Image Form
The space.vars.product\_acronym UI checks whether it can reach the Image Library Service endpoint when you open the **Add Image** form. If the check fails, a red **Action Required** heading appears at the top of the form with a count of outstanding items. Select the heading to open the **Action Required** dialog, which lists the actions needed to access the Image Library endpoint.
When Chrome has not granted Local Network Access, the dialog includes an **Allow Local Network Access** item that asks you to allow Local Network Access in your browser so the page can connect to the Image Library endpoint. This item always appears together with another item, either **Trust Image Library Certificate** or **Image Library Host Not Reachable**, because the UI cannot tell a blocked local network request apart from an untrusted certificate or an unreachable host. Seeing the **Allow Local Network Access** item does not by itself mean that Local Network Access is the cause. Check the browser permission first, then work through the other item if the heading remains.
The UI rechecks the endpoint every 30 seconds and when you refresh the page. After you grant Local Network Access, the **Allow Local Network Access** item is removed as soon as the browser reports the new permission state, and the **Action Required** heading clears after the next successful check.
### Re-Enable a Blocked Permission
If you dismissed or blocked the prompt, grant the permission from Chrome's site settings:
1. In Chrome, select the icon to the left of the address bar (the padlock or tune icon) while viewing the space.vars.product\_acronym UI.
2. Select **Site settings**.
3. Under **Permissions**, find **Local network access** and set it to **Allow**.
4. Reload the space.vars.product\_acronym UI and open the **Add Image** form again.
## Troubleshooting Certificate Issues
| Symptom | Likely Cause | Resolution |
| ---------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| UI upload button is not active; certificate warning shown | Certificate not accepted in this browser | Follow the browser-acceptance steps above. |
| `SSL: CERTIFICATE_VERIFY_FAILED` in CLI output | `--insecure` flag omitted, or a CA-signed cert whose CA is not trusted | Add `--insecure`, or add the CA certificate to the system trust store. |
| Certificate accepted, but upload still blocked | Browser cached an older, untrusted state | Clear the browser cache or retry in a private window. |
| Custom certificate applied but endpoint still shows old cert | Service not restarted after cert change | Run `sudo systemctl restart pf9-glance-api` on the Image Library host. |
| **Action Required** still shows in the **Add Image** form in Chrome, even after the certificate is trusted | Local Network Access permission not granted in Chrome | Grant Local Network access; see [Local Network Access in Chrome](#local-network-access-in-chrome) above. |
For general Image Library Service health checks, see [Image Library Service Endpoint Health](/private-cloud-director/2026.4/images-and-image-library/troubleshooting-and-log-files/image-service-troubleshooting-guide.md#image-library-service-endpoint-health).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.platform9.com/private-cloud-director/2026.4/images-and-image-library/image-library-certificate-configuration.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.