diff --git a/tests/configs/Certificate.yaml.j2 b/tests/configs/Certificate.yaml.j2
new file mode 100644
index 0000000..130c39c
--- /dev/null
+++ b/tests/configs/Certificate.yaml.j2
@@ -0,0 +1,20 @@
+uuid: 200f3290-3a3f-47ac-8149-dbe26c82ee34
+organisation: InterDiode
+description: Certificate test configuration
+configurations:
+  certificates:
+  - name: Test CA
+    content: |
+{{ 'certs/test-ca.crt.pem' | file | indent(6, first=true) }}
+  apt:
+    sources: []
+    keys: []
+  apk:
+    repositories: []
+  yum:
+    repositories: []
+    keys: []
+  python:
+    repositories: []
+  java:
+    repositories: []
diff --git a/tests/dockerfiles/Apk.Dockerfile b/tests/dockerfiles/Apk.Dockerfile
index fcee413..4232ca3 100644
--- a/tests/dockerfiles/Apk.Dockerfile
+++ b/tests/dockerfiles/Apk.Dockerfile
@@ -1,9 +1,9 @@
-FROM alpine:3.20 AS detection
+FROM alpine:3.20 AS target
 FROM interdiode/id-configurator:latest AS configuration
-COPY --from=detection / /src/
+COPY --from=target / /src/
 COPY --from=generated-config Apk.yaml /config.yaml
 RUN id-configurator apply --config /config.yaml --src /src --dst /dst
-FROM alpine:3.20 AS runtime
+FROM target AS runtime
 COPY --from=configuration /dst/ /
 RUN apk update \
     && apk add idconfiguratortestpkg \
diff --git a/tests/dockerfiles/Apt.Dockerfile b/tests/dockerfiles/Apt.Dockerfile
index 77b3430..06bb4ac 100644
--- a/tests/dockerfiles/Apt.Dockerfile
+++ b/tests/dockerfiles/Apt.Dockerfile
@@ -1,9 +1,9 @@
-FROM debian:trixie-slim AS detection
+FROM debian:trixie-slim AS target
 FROM interdiode/id-configurator:latest AS configuration
-COPY --from=detection / /src/
+COPY --from=target / /src/
 COPY --from=generated-config Apt.yaml /config.yaml
 RUN id-configurator apply --config /config.yaml --src /src --dst /dst
-FROM debian:trixie-slim AS runtime
+FROM target AS runtime
 COPY --from=configuration /dst/ /
 RUN apt-get update \
     && apt-get install -y --no-install-recommends idconfiguratortestpkg \
diff --git a/tests/dockerfiles/Certificate.Dockerfile b/tests/dockerfiles/Certificate.Dockerfile
new file mode 100644
index 0000000..d1fa354
--- /dev/null
+++ b/tests/dockerfiles/Certificate.Dockerfile
@@ -0,0 +1,11 @@
+FROM debian:trixie-slim AS target
+FROM interdiode/id-configurator:latest AS configuration
+COPY --from=target / /src/
+COPY --from=generated-config Certificate.yaml /config.yaml
+RUN id-configurator apply --config /config.yaml --src /src --dst /dst
+FROM target AS runtime
+ARG CERTIFICATE_REPO_PORT
+RUN apt-get update && apt-get install -y --no-install-recommends wget curl
+COPY --from=configuration /dst/ /
+RUN wget -qO- "https://host.docker.internal:${CERTIFICATE_REPO_PORT}/marker.txt" | grep -qx trusted-via-root-ca
+RUN curl -fsS "https://host.docker.internal:${CERTIFICATE_REPO_PORT}/marker.txt" | grep -qx trusted-via-root-ca
diff --git a/tests/dockerfiles/Java.Dockerfile b/tests/dockerfiles/Java.Dockerfile
index 58aa3c8..17333be 100644
--- a/tests/dockerfiles/Java.Dockerfile
+++ b/tests/dockerfiles/Java.Dockerfile
@@ -1,9 +1,9 @@
-FROM maven:3.9-eclipse-temurin-21 AS detection
+FROM maven:3.9-eclipse-temurin-21 AS target
 FROM interdiode/id-configurator:latest AS configuration
-COPY --from=detection / /src/
+COPY --from=target / /src/
 COPY --from=generated-config Java.yaml /config.yaml
 RUN id-configurator apply --config /config.yaml --src /src --dst /dst
-FROM maven:3.9-eclipse-temurin-21 AS runtime
+FROM target AS runtime
 # Warm up the local repository with the maven-dependency-plugin itself (from
 # the real, network-reachable Maven Central) while the default mirror is
 # still in place, so the actual test below never needs anything but the
diff --git a/tests/dockerfiles/Python.Dockerfile b/tests/dockerfiles/Python.Dockerfile
index e7d065e..a377572 100644
--- a/tests/dockerfiles/Python.Dockerfile
+++ b/tests/dockerfiles/Python.Dockerfile
@@ -1,9 +1,9 @@
-FROM python:3.13-slim AS detection
+FROM python:3.13-slim AS target
 FROM interdiode/id-configurator:latest AS configuration
-COPY --from=detection / /src/
+COPY --from=target / /src/
 COPY --from=generated-config Python.yaml /config.yaml
 RUN id-configurator apply --config /config.yaml --src /src --dst /dst
-FROM python:3.13-slim AS runtime
+FROM target AS runtime
 COPY --from=configuration /dst/ /
 RUN pip install --no-cache-dir idconfiguratortestpkg \
     && python3 -c "import idconfiguratortestpkg"
diff --git a/tests/dockerfiles/Yum.Dockerfile b/tests/dockerfiles/Yum.Dockerfile
index 5d8d750..16564a9 100644
--- a/tests/dockerfiles/Yum.Dockerfile
+++ b/tests/dockerfiles/Yum.Dockerfile
@@ -1,9 +1,9 @@
-FROM rockylinux:9 AS detection
+FROM rockylinux:9 AS target
 FROM interdiode/id-configurator:latest AS configuration
-COPY --from=detection / /src/
+COPY --from=target / /src/
 COPY --from=generated-config Yum.yaml /config.yaml
 RUN id-configurator apply --config /config.yaml --src /src --dst /dst
-FROM rockylinux:9 AS runtime
+FROM target AS runtime
 COPY --from=configuration /dst/ /
 RUN dnf install -y idconfiguratortestpkg \
     && rpm -q idconfiguratortestpkg
diff --git a/tox.ini b/tox.ini
index 1877b99..a253628 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,5 +1,5 @@
 [tox]
-env_list = py313,py314,coverage,packaging,publish,module-python,module-apt,module-yum,module-apk,module-java
+env_list = py313,py314,coverage,packaging,publish,module-python,module-apt,module-yum,module-apk,module-java,module-certificates
 isolated_build = true
 requires =
     tox>=4
@@ -176,3 +176,30 @@ allowlist_externals =
 commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/Java.yaml.j2 {env_dir}/configs/Java.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Java.Dockerfile -t id-configurator-java .
+
+[docker:certificate-repo]
+dockerfile = {tox_root}/tests/dockerfiles/repos/certificate-repo.Dockerfile
+expose =
+    CERTIFICATE_REPO_PORT=8443/tcp
+healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/marker.txt || exit 1
+healthcheck_interval = 1
+healthcheck_retries = 30
+healthcheck_timeout = 2
+healthcheck_start_period = 1
+
+[testenv:module-certificates]
+package = skip
+change_dir = {tox_root}
+dependency_groups = dev
+docker =
+    certificate-repo
+allowlist_externals =
+    docker
+description =
+    Verifies that both wget and curl - two independently TLS-linked HTTP
+    clients (GnuTLS and OpenSSL, respectively, on Debian) - trust an HTTPS
+    server whose certificate chains to a root certificate installed by the
+    `certificates` module alone, with no package-manager-specific config.
+commands =
+    python3 -m id_tools test render-config {tox_root}/tests/configs/Certificate.yaml.j2 {env_dir}/configs/Certificate.yaml
+    docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg CERTIFICATE_REPO_PORT={env:CERTIFICATE_REPO_PORT} --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/Certificate.Dockerfile -t id-configurator-certificates .