save changes

src/Policy/StellaOps.Policy.Engine/Program.cs

@@ -291,6 +291,17 @@ builder.Services.AddStellaOpsResourceServerAuthentication(
     builder.Configuration,
     configurationSection: $"{PolicyEngineOptions.SectionName}:ResourceServer");
 
+// Accept self-signed certificates when HTTPS metadata validation is disabled (dev/Docker)
+if (!bootstrap.Options.ResourceServer.RequireHttpsMetadata)
+{
+    builder.Services.AddHttpClient("StellaOps.Auth.ServerIntegration.Metadata")
+        .ConfigurePrimaryHttpMessageHandler(() => new HttpClientHandler
+        {
+            ServerCertificateCustomValidationCallback =
+                HttpClientHandler.DangerousAcceptAnyServerCertificateValidator
+        });
+}
+
 if (bootstrap.Options.Authority.Enabled)
 {
     builder.Services.AddStellaOpsAuthClient(clientOptions =>