{
  "slug": "cypress-trustedcertificates-enables-disk-caching-for-declared-certificate-origin-737e8dbd42ba",
  "title": "Cypress trustedCertificates enables disk caching for declared certificate origins",
  "tools": [
    "cypress"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-09-15T00:00:00.000Z",
  "announced_at": "2026-09-15T00:00:00.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When running asset-heavy specs on Chrome, Chromium, or Edge with an untrusted application certificate, add that certificate or its SPKI fingerprint to `trustedCertificates`. Cypress then lets the browser trust the declared origin so its static assets can be cached across navigations.",
    "examples": [
      "const { defineConfig } = require('cypress')\nmodule.exports = defineConfig({\n  trustedCertificates: [{ filePath: '<project-relative-path-to-PEM-certificate>' }],\n})",
      "const { defineConfig } = require('cypress')\nmodule.exports = defineConfig({\n  trustedCertificates: [{ pem: '<inline-PEM-certificate-text>' }],\n})",
      "const { defineConfig } = require('cypress')\nmodule.exports = defineConfig({\n  trustedCertificates: [{ spki: '<44-character-base64-SHA-256-SPKI-fingerprint-ending-in-equals>' }],\n})"
    ],
    "gotchas": [
      "Version: 16.1.0",
      "trustedCertificates: Optional array of certificate entries; defaults to `[]`.",
      "trustedCertificates[].filePath: Path to a PEM-encoded certificate file; relative paths resolve against the project root. Exactly one entry key must be used.",
      "trustedCertificates[].pem: Inline PEM-encoded certificate text. Every certificate in the PEM string is trusted. Exactly one entry key must be used.",
      "trustedCertificates[].spki: Precomputed base64-encoded SHA-256 fingerprint of the certificate SPKI; exactly 44 characters ending in `=`. Exactly one entry key must be used.",
      "filePath, pem, spki exclusivity (required): Each entry must contain exactly one of these keys; using zero or multiple keys causes configuration validation error. They are mutually exclusive.",
      "Prerequisite: Cypress 16.1.0 or later; the option was added in 16.1.0.",
      "Prerequisite: Applies on the native browser network path in Chrome, Chromium, and Edge. It has no effect in Firefox, WebKit, Electron, or when `forceHttp1: true`.",
      "Prerequisite: A `filePath` entry must be readable and PEM data must parse; those failures occur at browser launch. Validation checks entry shape first.",
      "Applies on the native browser network path in Chrome, Chromium, and Edge.",
      "Origins not declared continue to load as before.",
      "Firefox, WebKit, Electron, and `forceHttp1` runs are unaffected."
    ]
  },
  "why_it_matters": "Run asset-heavy specs against an application presenting an untrusted development certificate on Chrome, Chromium, or Edge.",
  "before": "Before this change, responses from an untrusted-certificate origin were not written to the browser disk cache, so asset-heavy specs re-downloaded assets on each `cy.visit()`.",
  "sources": [
    "https://docs.cypress.io/app/references/changelog#16-1-0",
    "https://docs.cypress.io/app/references/configuration"
  ],
  "rank": 0.93026,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2b-20261017",
    "verdict_id": "wave2b-20261017:wave2b-20261017-d359b5709587610a-0:gate",
    "evidence_hash": "af2ddbe8cd346a2addb0d1e1ed098ab0f2ee7fa75350884657a5a5a56448331a"
  },
  "review": {
    "draft_hash": "bdacee2469042dfcdf037c72fd40ac517f66aa1045edf4f4c76c1bc74b50c501",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave2b-20261017:gate",
    "reason": "2 of 3 judge runs approved with p_yes >= 0.9 (mean 0.93 >= 0.9; 2 needed) and Jev gave 0.66 (>= 0.6 needed)."
  }
}