diff --git a/tests/dockerfiles/Certificate.Dockerfile b/tests/dockerfiles/Certificate.Dockerfile
index d1fa354..029cde8 100644
--- a/tests/dockerfiles/Certificate.Dockerfile
+++ b/tests/dockerfiles/Certificate.Dockerfile
@@ -5,7 +5,11 @@ COPY --from=generated-config Certificate.yaml /config.yaml
 RUN id-configurator apply --config /config.yaml --src /src --dst /dst
 FROM target AS runtime
 ARG CERTIFICATE_REPO_PORT
-RUN apt-get update && apt-get install -y --no-install-recommends wget curl
+RUN apt-get update && apt-get install -y --no-install-recommends wget curl git openssl
 COPY --from=configuration /dst/ /
 RUN wget -qO- "https://host.docker.internal:${CERTIFICATE_REPO_PORT}/marker.txt" | grep -qx trusted-via-root-ca
 RUN curl -fsS "https://host.docker.internal:${CERTIFICATE_REPO_PORT}/marker.txt" | grep -qx trusted-via-root-ca
+RUN git clone -q "https://host.docker.internal:${CERTIFICATE_REPO_PORT}/repo.git" /tmp/clone \
+    && grep -qx trusted-via-root-ca /tmp/clone/marker.txt
+RUN echo | openssl s_client -connect "host.docker.internal:${CERTIFICATE_REPO_PORT}" \
+    -servername host.docker.internal -verify_hostname host.docker.internal -verify_return_error
diff --git a/tests/dockerfiles/repos/certificate-repo.Dockerfile b/tests/dockerfiles/repos/certificate-repo.Dockerfile
index 8bcfb97..9748bc1 100644
--- a/tests/dockerfiles/repos/certificate-repo.Dockerfile
+++ b/tests/dockerfiles/repos/certificate-repo.Dockerfile
@@ -2,13 +2,30 @@
 # used by tox-docker to exercise the `certificates` module integration test
 # (tests/configs/Certificate.yaml.j2, tests/dockerfiles/Certificate.Dockerfile).
 # Unlike the package-manager fixtures, this one has nothing to do with a
-# specific package format: it just serves a static marker file that wget and
-# curl are expected to fetch once the root certificate is trusted.
+# specific package format: it serves a static marker file (for wget, curl and
+# openssl s_client) and a bare git repository over the "dumb" HTTP protocol
+# (for `git clone`).
 #
 # Built by tox-docker, whose build context is this directory (not the repo
 # root) - every COPY source below must live under tests/dockerfiles/repos/.
+FROM alpine:3.20 AS gitbuild
+RUN apk add --no-cache git
+RUN git config --global init.defaultBranch main \
+    && git config --global user.email test@example.invalid \
+    && git config --global user.name "id-configurator tests"
+RUN mkdir -p /work \
+    && cd /work \
+    && git init -q \
+    && echo "trusted-via-root-ca" > marker.txt \
+    && git add marker.txt \
+    && git commit -q -m "initial commit"
+RUN git clone --bare -q /work /srv/repo.git \
+    && cd /srv/repo.git \
+    && git update-server-info
+
 FROM nginx:alpine
 RUN mkdir -p /srv && echo "trusted-via-root-ca" > /srv/marker.txt
+COPY --from=gitbuild /srv/repo.git /srv/repo.git
 COPY repo-server.crt.pem /etc/nginx/certs/repo-server.crt.pem
 COPY repo-server.key.pem /etc/nginx/certs/repo-server.key.pem
 COPY certificate-repo.nginx.conf /etc/nginx/conf.d/default.conf