# Manual Server CA and exclusive Client trust

Runewarp's manual Server certificate path uses a private Server CA that issues the leaf certificate for the Server hostname, and a Client selects exclusive CA-bundle trust with `client.server-trust = "ca-file"` while `client.server-ca-file` optionally overrides the default bundle path. We chose this so ordinary manual Server leaf renewal can happen without changing Client trust, and so operators who configure their own Runewarp trust anchor do not silently keep trusting unrelated public roots. The simple manual path may colocate the private Server CA key with the public Server in `state/` for operational simplicity, but that trade-off must stay documented and ACME remains the expected default for most operators.
