diff --git a/projects/ca_certificates/brioche.lock b/projects/ca_certificates/brioche.lock
new file mode 100644
index 0000000..18a1e41
--- /dev/null
+++ b/projects/ca_certificates/brioche.lock
@@ -0,0 +1,3 @@
+{
+  "dependencies": {}
+}
diff --git a/projects/ca_certificates/project.bri b/projects/ca_certificates/project.bri
new file mode 100644
index 0000000..da5f2fd
--- /dev/null
+++ b/projects/ca_certificates/project.bri
@@ -0,0 +1,30 @@
+import * as std from "std";
+
+export const project = {
+  name: "ca_certificates",
+  version: "2024-03-11",
+};
+
+export default (): std.Recipe<std.Directory> => {
+  const cacert = std.download({
+    url: `https://curl.se/ca/cacert-${project.version}.pem`,
+    hash: std.sha256Hash(
+      "1794c1d4f7055b7d02c2170337b61b48a2ef6c90d77e95444fd2596f4cac609f",
+    ),
+  });
+
+  return std.setEnv(
+    std.directory({
+      etc: std.directory({
+        ssl: std.directory({
+          certs: std.directory({
+            "ca-bundle.crt": cacert,
+          }),
+        }),
+      }),
+    }),
+    {
+      SSL_CERT_FILE: { path: "etc/ssl/certs/ca-bundle.crt" },
+    },
+  );
+};