In general with HTTPS verification, you need to use a trusted CA. (I'm simplifying this a lot...beware.) Applications/operating systems contain trusted CA bundles of global CAs. Most of those charge to get a signed cert. However, for private usage, you can always add your own self-signed CAs to your system trust bundles or your application SSL verification settings. Large enterprises typically have some sort of PKI (public key infrastructure) for managing certs signed by their own CAs. I'm not a security engineer and I'm sure a security engineer would have a lot more to add about how to use self-signed CAs correctly, but they're certainly appropriate for internal use cases like this.