diff --git a/tests/dockerfiles/repos/certificate-repo.Dockerfile b/tests/dockerfiles/repos/certificate-repo.Dockerfile
new file mode 100644
index 0000000..8bcfb97
--- /dev/null
+++ b/tests/dockerfiles/repos/certificate-repo.Dockerfile
@@ -0,0 +1,15 @@
+# Minimal HTTPS server, using the same Test CA as the other *-repo fixtures,
+# used by tox-docker to exercise the `certificates` module integration test
+# (tests/configs/Certificate.yaml.j2, tests/dockerfiles/Certificate.Dockerfile).
+# Unlike the package-manager fixtures, this one has nothing to do with a
+# specific package format: it just serves a static marker file that wget and
+# curl are expected to fetch once the root certificate is trusted.
+#
+# Built by tox-docker, whose build context is this directory (not the repo
+# root) - every COPY source below must live under tests/dockerfiles/repos/.
+FROM nginx:alpine
+RUN mkdir -p /srv && echo "trusted-via-root-ca" > /srv/marker.txt
+COPY repo-server.crt.pem /etc/nginx/certs/repo-server.crt.pem
+COPY repo-server.key.pem /etc/nginx/certs/repo-server.key.pem
+COPY certificate-repo.nginx.conf /etc/nginx/conf.d/default.conf
+EXPOSE 8443
diff --git a/tests/dockerfiles/repos/certificate-repo.nginx.conf b/tests/dockerfiles/repos/certificate-repo.nginx.conf
new file mode 100644
index 0000000..aafed09
--- /dev/null
+++ b/tests/dockerfiles/repos/certificate-repo.nginx.conf
@@ -0,0 +1,10 @@
+server {
+    listen 8443 ssl default_server;
+    server_name _;
+
+    ssl_certificate     /etc/nginx/certs/repo-server.crt.pem;
+    ssl_certificate_key /etc/nginx/certs/repo-server.key.pem;
+
+    root /srv;
+    autoindex off;
+}