# Configure TLS on an HTTP server (/docs/guides/http/tls)

<!-- agent-signals: reading_time_min: 1 · est_tokens: 214 · updated: 2026-07-28 -->
Related: [Common HTTP server usage](/docs/guides/http/server.md), [Write a simple HTTP server](/docs/guides/http/simple.md), [Send an HTTP request using fetch](/docs/guides/http/fetch.md), [Hot reload an HTTP server](/docs/guides/http/hot.md), [Start a cluster of HTTP servers](/docs/guides/http/cluster.md), [Proxy HTTP requests using fetch()](/docs/guides/http/proxy.md)

Set the `tls` key to configure TLS. Both `key` and `cert` are required: `key` is the contents of your private key and `cert` is the contents of your issued certificate. Use [`Bun.file()`](/runtime/file-io#reading-files-bun-file) to read them.

```ts server.ts icon="/icons/typescript.svg"
const server = Bun.serve({
  fetch: request => new Response("Welcome to Bun!"),
  tls: {
    cert: Bun.file("cert.pem"),
    key: Bun.file("key.pem"),
  },
});
```

***

By default, Bun trusts the Mozilla-curated list of well-known root CAs. To override this list, pass an array of certificates as `ca`.

```ts server.ts icon="/icons/typescript.svg"
const server = Bun.serve({
  fetch: request => new Response("Welcome to Bun!"),
  tls: {
    cert: Bun.file("cert.pem"),
    key: Bun.file("key.pem"),
    ca: [Bun.file("ca1.pem"), Bun.file("ca2.pem")],
  },
});
```