diff --git a/.github/workflows/shared-test-workflow.yml b/.github/workflows/shared-test-workflow.yml
index db868ea5..0c9524f3 100644
--- a/.github/workflows/shared-test-workflow.yml
+++ b/.github/workflows/shared-test-workflow.yml
@@ -26,6 +26,7 @@ env:
 
 jobs:
   integration-test:
+    name: Test on ${{ inputs.environment_name }}
     if: ${{ vars.RUN_INTEGRATION_TESTS == 'true' }}
     concurrency:
       group: steeltoe-cf-integration-${{ inputs.environment_name }}-${{ inputs.feature }}-${{ inputs.sample }}-${{ inputs.OS }}
@@ -37,7 +38,68 @@ jobs:
     steps:
     - name: Decide whether to run integration test
       id: should_run
-      run: echo "run=${{ inputs.OS != 'windows' || vars.ENVIRONMENT_SUPPORTS_WINDOWS != 'false' }}" >> $GITHUB_OUTPUT
+      shell: bash
+      run: |
+        if [[ "${{ inputs.OS }}" == "windows" && "${{ vars.ENVIRONMENT_SUPPORTS_WINDOWS }}" == "false" ]]; then
+          echo "Environment '${{ inputs.environment_name }}' does not support Windows. Skipping."
+          echo "run=false" >> $GITHUB_OUTPUT
+          exit 0
+        fi
+
+        if [[ "${{ inputs.environment_name }}" == "shepherd" ]]; then
+          if [[ -z "${{ vars.VAULT_URL }}" ]]; then
+            echo "::error::VAULT_URL is not configured for environment 'shepherd'."
+            exit 1
+          fi
+        elif [[ -z "${{ vars.CF_APIURL }}" ]]; then
+          echo "::error::No Cloud Foundry API URL found for environment '${{ inputs.environment_name }}'. Ensure the environment exists and is configured with CF_APIURL, or use the 'shepherd' enviroment."
+          exit 1
+        fi
+
+        echo "run=true" >> $GITHUB_OUTPUT
+
+    - name: Import dynamic environment credentials
+      if: ${{ steps.should_run.outputs.run == 'true' && inputs.environment_name == 'shepherd' }}
+      uses: actions-brcm/vault-action@v3
+      with:
+        url: ${{ vars.VAULT_URL }}
+        method: approle
+        roleId: ${{ secrets.VAULT_ROLE_ID }}
+        secretId: ${{ secrets.VAULT_SECRET_ID }}
+        secrets: |
+          ${{ vars.VAULT_PATH }} cf_apiurl | CF_APIURL ;
+          ${{ vars.VAULT_PATH }} cf_password | CF_PASSWORD ;
+          ${{ vars.VAULT_PATH }} cf_username | CF_USERNAME ;
+          ${{ vars.VAULT_PATH }} cf_org | CF_ORG ;
+          ${{ vars.VAULT_PATH }} http_proxy | HTTP_PROXY ;
+          ${{ vars.VAULT_PATH }} foundation_ready | FOUNDATION_READY ;
+          ${{ vars.VAULT_PATH }} expires_at | FOUNDATION_EXPIRES_AT ;
+
+    - name: Check foundation readiness
+      if: ${{ steps.should_run.outputs.run == 'true' && inputs.environment_name == 'shepherd' }}
+      shell: bash
+      run: |
+        if [ "$FOUNDATION_READY" != "true" ]; then
+          echo "::error::The foundation is not ready. Run the provisioner."
+          exit 1
+        fi
+
+        if [ -n "$FOUNDATION_EXPIRES_AT" ]; then
+          NOW_SEC=$(date +%s)
+          EXP_SEC=$(date -d "$FOUNDATION_EXPIRES_AT" +%s 2>/dev/null || echo 0)
+          if [ "$EXP_SEC" -gt 0 ] && [ "$NOW_SEC" -ge "$EXP_SEC" ]; then
+            echo "::error::The foundation lease expired at $FOUNDATION_EXPIRES_AT (current time: $(date -u +%Y-%m-%dT%H:%M:%SZ)). Run the provisioner."
+            exit 1
+          fi
+          REMAINING_HOURS=$(( (EXP_SEC - NOW_SEC) / 3600 ))
+          echo "Foundation is ready. Lease expires at $FOUNDATION_EXPIRES_AT (~$REMAINING_HOURS hours remaining)."
+        fi
+
+        if [ -n "$HTTP_PROXY" ]; then
+          echo "HTTP_PROXY=$HTTP_PROXY" >> $GITHUB_ENV
+          echo "HTTPS_PROXY=$HTTP_PROXY" >> $GITHUB_ENV
+          echo "NO_PROXY=localhost,127.0.0.1,.internal" >> $GITHUB_ENV
+        fi
 
     - name: Setup .NET
       if: ${{ steps.should_run.outputs.run == 'true' }}
@@ -78,7 +140,11 @@ jobs:
     - name: Configure Cloud Foundry settings
       if: ${{ steps.should_run.outputs.run == 'true' }}
       env:
-        CF_PASSWORD: ${{ secrets.CF_PASSWORD }}
+        CF_PASSWORD_ENV: ${{ env.CF_PASSWORD }}
+        CF_PASSWORD_SECRET: ${{ secrets.CF_PASSWORD }}
+        CF_APIURL_ENV: ${{ env.CF_APIURL }}
+        CF_ORG_ENV: ${{ env.CF_ORG }}
+        CF_USERNAME_ENV: ${{ env.CF_USERNAME }}
       run: |
         if [[ "${{ github.event_name }}" == "pull_request" ]]; then
           IDENTIFIER="pr-${{ github.event.pull_request.number }}"
@@ -89,24 +155,32 @@ jobs:
         if [[ -n "${{ vars.CF_SPACE }}" ]]; then
           SPACE_NAME="${{ vars.CF_SPACE }}"
         else
-          RAW_SPACE_NAME="sample-${IDENTIFIER}_${{ inputs.feature }}-${{ inputs.sample }}"
+          RAW_SPACE_NAME="sample-${IDENTIFIER}_${{ inputs.feature }}-${{ inputs.sample }}-${{ inputs.OS }}"
           # Replace all non-alphanumeric, non-underscore, non-hyphen characters with "-"
           SPACE_NAME=$(echo "$RAW_SPACE_NAME" | sed 's/[^a-zA-Z0-9_-]/-/g')
         fi
 
+        CF_APIURL_VAL="${CF_APIURL_ENV:-${{ vars.CF_APIURL }}}"
+        CF_ORG_VAL="${CF_ORG_ENV:-${{ vars.CF_ORG }}}"
+        CF_USERNAME_VAL="${CF_USERNAME_ENV:-${{ vars.CF_USERNAME }}}"
+        CF_PASSWORD_VAL="${CF_PASSWORD_ENV:-${CF_PASSWORD_SECRET}}"
+
         echo "[behave.userdata]" >> user.ini
         [[ -n "${{ vars.CLEANUP }}" ]] && echo "cleanup = ${{ vars.CLEANUP }}" >> user.ini
         [[ -n "${{ vars.CMD_MAX_ATTEMPTS }}" ]] && echo "cmd_max_attempts = ${{ vars.CMD_MAX_ATTEMPTS }}" >> user.ini
         [[ -n "${{ vars.CF_MAX_ATTEMPTS }}" ]] && echo "cf_max_attempts = ${{ vars.CF_MAX_ATTEMPTS }}" >> user.ini
         [[ -n "${{ vars.CMD_LOOP_WAIT }}" ]] && echo "cmd_loop_wait = ${{ vars.CMD_LOOP_WAIT }}" >> user.ini
-        [[ -n "${{ vars.CF_APIURL }}" ]] && echo "cf_apiurl = ${{ vars.CF_APIURL }}" >> user.ini
-        [[ -n "${{ vars.CF_ORG }}" ]] && echo "cf_org = ${{ vars.CF_ORG }}" >> user.ini
+        [[ -n "$CF_APIURL_VAL" ]] && echo "cf_apiurl = $CF_APIURL_VAL" >> user.ini
+        [[ -n "$CF_ORG_VAL" ]] && echo "cf_org = $CF_ORG_VAL" >> user.ini
         echo "cf_space = $SPACE_NAME" >> user.ini
-        [[ -n "${{ vars.CF_USERNAME }}" ]] && echo "cf_username = ${{ vars.CF_USERNAME }}" >> user.ini
-        [[ -n "$CF_PASSWORD" ]] && echo "cf_password = $CF_PASSWORD" >> user.ini
+        [[ -n "$CF_USERNAME_VAL" ]] && echo "cf_username = $CF_USERNAME_VAL" >> user.ini
+        [[ -n "$CF_PASSWORD_VAL" ]] && echo "cf_password = $CF_PASSWORD_VAL" >> user.ini
+        if [[ "${{ vars.CF_SKIP_SSL_VALIDATION }}" == "true" ]]; then
+          echo "cf_skip_ssl_validation = yes" >> user.ini
+        fi
         cat user.ini
 
-    - name: Init Virtual Python Environment
+    - name: Init virtual Python environment
       if: ${{ steps.should_run.outputs.run == 'true' }}
       run: touch reinit
 
diff --git a/Configuration/src/ConfigurationProviders/manifest-windows.yml b/Configuration/src/ConfigurationProviders/manifest-windows.yml
index 4a05656d..7c79f87d 100644
--- a/Configuration/src/ConfigurationProviders/manifest-windows.yml
+++ b/Configuration/src/ConfigurationProviders/manifest-windows.yml
@@ -5,7 +5,7 @@ applications:
   - binary_buildpack
   memory: 256M
   random-route: true
-  stack: windows
+  stack: windows2022
   command: cmd /c .\Steeltoe.Samples.ConfigurationProviders --urls=http://0.0.0.0:%PORT%
   env:
     # ASPNETCORE_ENVIRONMENT value is lower-cased here to match the files in the config repository at:
diff --git a/Connectors/src/MongoDb/manifest-windows.yml b/Connectors/src/MongoDb/manifest-windows.yml
index c0782c78..1b9a1e8c 100644
--- a/Connectors/src/MongoDb/manifest-windows.yml
+++ b/Connectors/src/MongoDb/manifest-windows.yml
@@ -3,7 +3,7 @@ applications:
 - name: mongodb-connector-sample
   random-route: true
   memory: 256M
-  stack: windows
+  stack: windows2022
   buildpacks:
    - binary_buildpack
   command: cmd /c .\Steeltoe.Samples.MongoDb --urls=http://0.0.0.0:%PORT%
diff --git a/Connectors/src/MySql/manifest-windows.yml b/Connectors/src/MySql/manifest-windows.yml
index 3c407b0d..462d33f3 100644
--- a/Connectors/src/MySql/manifest-windows.yml
+++ b/Connectors/src/MySql/manifest-windows.yml
@@ -3,7 +3,7 @@ applications:
 - name: mysql-connector-sample
   random-route: true
   memory: 256M
-  stack: windows
+  stack: windows2022
   buildpacks:
    - binary_buildpack
   command: cmd /c .\Steeltoe.Samples.MySql --urls=http://0.0.0.0:%PORT%
diff --git a/Connectors/src/MySqlEFCore/manifest-windows.yml b/Connectors/src/MySqlEFCore/manifest-windows.yml
index 794bb769..bf937f43 100644
--- a/Connectors/src/MySqlEFCore/manifest-windows.yml
+++ b/Connectors/src/MySqlEFCore/manifest-windows.yml
@@ -3,7 +3,7 @@ applications:
 - name: mysql-efcore-connector-sample
   random-route: true
   memory: 256M
-  stack: windows
+  stack: windows2022
   buildpacks:
    - binary_buildpack
   command: cmd /c .\Steeltoe.Samples.MySqlEFCore --urls=http://0.0.0.0:%PORT%
diff --git a/Connectors/src/PostgreSql/manifest-windows.yml b/Connectors/src/PostgreSql/manifest-windows.yml
index 58f9ec92..c52dddc4 100644
--- a/Connectors/src/PostgreSql/manifest-windows.yml
+++ b/Connectors/src/PostgreSql/manifest-windows.yml
@@ -3,7 +3,7 @@ applications:
 - name: postgresql-connector-sample
   random-route: true
   memory: 256M
-  stack: windows
+  stack: windows2022
   buildpacks:
    - binary_buildpack
   command: cmd /c .\Steeltoe.Samples.PostgreSql --urls=http://0.0.0.0:%PORT%
diff --git a/Connectors/src/PostgreSqlEFCore/manifest-windows.yml b/Connectors/src/PostgreSqlEFCore/manifest-windows.yml
index dea0c576..756dafab 100644
--- a/Connectors/src/PostgreSqlEFCore/manifest-windows.yml
+++ b/Connectors/src/PostgreSqlEFCore/manifest-windows.yml
@@ -3,7 +3,7 @@ applications:
 - name: postgresql-efcore-connector-sample
   random-route: true
   memory: 256M
-  stack: windows
+  stack: windows2022
   buildpacks:
    - binary_buildpack
   command: cmd /c .\Steeltoe.Samples.PostgreSqlEFCore --urls=http://0.0.0.0:%PORT%
diff --git a/Connectors/src/RabbitMQ/manifest-windows.yml b/Connectors/src/RabbitMQ/manifest-windows.yml
index 65598860..0168961c 100644
--- a/Connectors/src/RabbitMQ/manifest-windows.yml
+++ b/Connectors/src/RabbitMQ/manifest-windows.yml
@@ -3,7 +3,7 @@ applications:
 - name: rabbitmq-connector-sample
   random-route: true
   memory: 256M
-  stack: windows
+  stack: windows2022
   buildpacks:
    - binary_buildpack
   command: cmd /c .\Steeltoe.Samples.RabbitMQ --urls=http://0.0.0.0:%PORT%
diff --git a/Connectors/src/Redis/manifest-windows.yml b/Connectors/src/Redis/manifest-windows.yml
index aa444b5a..b67ecab9 100644
--- a/Connectors/src/Redis/manifest-windows.yml
+++ b/Connectors/src/Redis/manifest-windows.yml
@@ -3,7 +3,7 @@ applications:
 - name: redis-connector-sample
   random-route: true
   memory: 256M
-  stack: windows
+  stack: windows2022
   buildpacks:
    - binary_buildpack
   command: cmd /c .\Steeltoe.Samples.Redis --urls=http://0.0.0.0:%PORT%
diff --git a/Connectors/src/SqlServerEFCore/manifest-windows.yml b/Connectors/src/SqlServerEFCore/manifest-windows.yml
index 4d9b93c5..1346de80 100644
--- a/Connectors/src/SqlServerEFCore/manifest-windows.yml
+++ b/Connectors/src/SqlServerEFCore/manifest-windows.yml
@@ -3,7 +3,7 @@ applications:
 - name: sqlserver-efcore-connector-sample
   random-route: true
   memory: 256M
-  stack: windows
+  stack: windows2022
   buildpacks:
    - binary_buildpack
   command: cmd /c .\Steeltoe.Samples.SqlServerEFCore --urls=http://0.0.0.0:%PORT%
diff --git a/Discovery/src/FortuneTeller/FortuneTellerApi/manifest-windows.yml b/Discovery/src/FortuneTeller/FortuneTellerApi/manifest-windows.yml
index 719d70dd..6eff093e 100644
--- a/Discovery/src/FortuneTeller/FortuneTellerApi/manifest-windows.yml
+++ b/Discovery/src/FortuneTeller/FortuneTellerApi/manifest-windows.yml
@@ -3,7 +3,7 @@ applications:
 - name: fortune-service-sample
   random-route: true
   memory: 256M
-  stack: windows
+  stack: windows2022
   buildpacks:
    - binary_buildpack
   command: cmd /c .\Steeltoe.Samples.FortuneTellerApi --urls=http://0.0.0.0:%PORT%
diff --git a/Discovery/src/FortuneTeller/FortuneTellerWeb/manifest-windows.yml b/Discovery/src/FortuneTeller/FortuneTellerWeb/manifest-windows.yml
index a45f8d1f..38a9483e 100644
--- a/Discovery/src/FortuneTeller/FortuneTellerWeb/manifest-windows.yml
+++ b/Discovery/src/FortuneTeller/FortuneTellerWeb/manifest-windows.yml
@@ -3,7 +3,7 @@ applications:
 - name: fortune-web-sample
   random-route: true
   memory: 256M
-  stack: windows
+  stack: windows2022
   buildpacks:
    - binary_buildpack
   command: cmd /c .\Steeltoe.Samples.FortuneTellerWeb --urls=http://0.0.0.0:%PORT%
diff --git a/FileShares/src/FileSharesWeb/manifest-windows.yml b/FileShares/src/FileSharesWeb/manifest-windows.yml
index a93397b0..686e4285 100644
--- a/FileShares/src/FileSharesWeb/manifest-windows.yml
+++ b/FileShares/src/FileSharesWeb/manifest-windows.yml
@@ -3,7 +3,7 @@ applications:
 - name: fileshares-sample
   random-route: true
   memory: 256M
-  stack: windows
+  stack: windows2022
   buildpacks:
    - binary_buildpack
   command: cmd /c .\Steeltoe.Samples.FileSharesWeb --urls=http://0.0.0.0:%PORT%
diff --git a/Management/src/ActuatorApi/manifest-windows.yml b/Management/src/ActuatorApi/manifest-windows.yml
index 2c85b43e..02eb78c2 100644
--- a/Management/src/ActuatorApi/manifest-windows.yml
+++ b/Management/src/ActuatorApi/manifest-windows.yml
@@ -4,7 +4,7 @@ applications:
   buildpacks:
    - binary_buildpack
   memory: 256M
-  stack: windows
+  stack: windows2022
   command: cmd /c .\Steeltoe.Samples.ActuatorApi --urls http://0.0.0.0:%PORT%
   env:
     DOTNET_CLI_TELEMETRY_OPTOUT: "true"
diff --git a/Management/src/ActuatorWeb/manifest-windows.yml b/Management/src/ActuatorWeb/manifest-windows.yml
index 5f82edd6..108e2fb8 100644
--- a/Management/src/ActuatorWeb/manifest-windows.yml
+++ b/Management/src/ActuatorWeb/manifest-windows.yml
@@ -4,7 +4,7 @@ applications:
   buildpacks:
    - binary_buildpack
   memory: 256M
-  stack: windows
+  stack: windows2022
   command: cmd /c .\Steeltoe.Samples.ActuatorWeb --urls http://0.0.0.0:%PORT%
   env:
     DOTNET_CLI_TELEMETRY_OPTOUT: "true"
diff --git a/Security/src/AuthApi/manifest-windows.yml b/Security/src/AuthApi/manifest-windows.yml
index 281a338e..2b8a579b 100644
--- a/Security/src/AuthApi/manifest-windows.yml
+++ b/Security/src/AuthApi/manifest-windows.yml
@@ -5,7 +5,7 @@ applications:
   - binary_buildpack
   command: cmd /c .\Steeltoe.Samples.AuthApi --urls=http://0.0.0.0:%PORT%
   memory: 256M
-  stack: windows
+  stack: windows2022
   env:
     DOTNET_CLI_TELEMETRY_OPTOUT: "true"
     DOTNET_NOLOGO: "true"
diff --git a/Security/src/AuthConsole/manifest-windows.yml b/Security/src/AuthConsole/manifest-windows.yml
index 7d6a7f5c..fc4a79d3 100644
--- a/Security/src/AuthConsole/manifest-windows.yml
+++ b/Security/src/AuthConsole/manifest-windows.yml
@@ -7,7 +7,7 @@ applications:
   health-check-type: process
   memory: 256M
   no-route: true
-  stack: windows
+  stack: windows2022
   env:
     DOTNET_CLI_TELEMETRY_OPTOUT: "true"
     DOTNET_NOLOGO: "true"
diff --git a/Security/src/AuthWeb/manifest-windows.yml b/Security/src/AuthWeb/manifest-windows.yml
index 1140e544..378fbe4f 100644
--- a/Security/src/AuthWeb/manifest-windows.yml
+++ b/Security/src/AuthWeb/manifest-windows.yml
@@ -5,7 +5,7 @@ applications:
   - binary_buildpack
   command: cmd /c .\Steeltoe.Samples.AuthWeb --urls=http://0.0.0.0:%PORT%
   memory: 256M
-  stack: windows
+  stack: windows2022
   env:
     DOTNET_CLI_TELEMETRY_OPTOUT: "true"
     DOTNET_NOLOGO: "true"
diff --git a/Security/src/RedisDataProtection/manifest-windows.yml b/Security/src/RedisDataProtection/manifest-windows.yml
index 6844b373..55ac4a94 100644
--- a/Security/src/RedisDataProtection/manifest-windows.yml
+++ b/Security/src/RedisDataProtection/manifest-windows.yml
@@ -3,7 +3,7 @@ applications:
 - name: redis-data-protection-sample
   random-route: true
   memory: 256M
-  stack: windows
+  stack: windows2022
   buildpacks:
    - binary_buildpack
   command: cmd /c .\Steeltoe.Samples.RedisDataProtection --urls=http://0.0.0.0:%PORT%
diff --git a/behave.ini b/behave.ini
index 204d993e..0f98f884 100644
--- a/behave.ini
+++ b/behave.ini
@@ -56,3 +56,8 @@ cf_max_attempts = 36
 ; if set, use as space name for all scenarios
 ; ----------------------------------------------------------------------------
 cf_space =
+
+; ----------------------------------------------------------------------------
+; whether to skip SSL certificate validation when logging into Cloud Foundry
+; ----------------------------------------------------------------------------
+cf_skip_ssl_validation = no
diff --git a/environment.py b/environment.py
index 382aa2a4..6bd3ed6a 100644
--- a/environment.py
+++ b/environment.py
@@ -231,6 +231,12 @@ def setup_options(context):
         context.log.error("invalid config option: cf_max_attempts -> {}".format(user_data.get('cf_max_attempts')))
         raise e
     context.log.info("option: CloudFoundry max attempts -> {}".format(context.options.cf.max_attempts))
+    try:
+        context.options.cf.skip_ssl_validation = user_data.getbool('cf_skip_ssl_validation')
+    except ValueError as e:
+        context.log.error("invalid config option: cf_skip_ssl_validation -> {}".format(user_data.get('cf_skip_ssl_validation')))
+        raise e
+    context.log.info("option: CloudFoundry skip SSL validation? -> {}".format(context.options.cf.skip_ssl_validation))
 
 
 def setup_platform(context):
diff --git a/pysteel/cloudfoundry.py b/pysteel/cloudfoundry.py
index a90ab45f..4926a3d4 100644
--- a/pysteel/cloudfoundry.py
+++ b/pysteel/cloudfoundry.py
@@ -20,7 +20,7 @@ class CloudFoundry(object):
     def __init__(self, context):
         self._context = context
 
-    def login(self, api_url, username, password, org, space):
+    def login(self, api_url, username, password, org, space, skip_ssl_validation=False):
         """
         Login to Cloud Foundry
         :type api_url: str
@@ -28,9 +28,12 @@ def login(self, api_url, username, password, org, space):
         :type password: str
         :type org: str
         :type space: str
+        :type skip_ssl_validation: bool
         """
         self._context.log.info('logging into Cloud Foundry')
         cmd_s = 'cf login -a {} -u {} -p {} -o {} -s {}'.format(api_url, username, password, org, space)
+        if skip_ssl_validation:
+            cmd_s += ' --skip-ssl-validation'
         command.Command(self._context, cmd_s).run()
 
     def get_api_endpoint(self):
diff --git a/pysteel/scaffold/cloudfoundry.py b/pysteel/scaffold/cloudfoundry.py
index e10baa52..7ae55cb1 100644
--- a/pysteel/scaffold/cloudfoundry.py
+++ b/pysteel/scaffold/cloudfoundry.py
@@ -24,7 +24,8 @@ def setup(context, scenario):
             context.options.cf.username,
             context.options.cf.password,
             context.options.cf.org,
-            'development'
+            'development',
+            skip_ssl_validation=context.options.cf.skip_ssl_validation
         )
     else:
         context.log.info('CloudFoundry credentials not provided, assuming already logged in')
@@ -57,8 +58,8 @@ def teardown(context, scenario):
     :type context: behave.runner.Context
     """
     cf = cloudfoundry.CloudFoundry(context)
-    if context.cf_space:
-        if context.cf_delete_space_on_teardown:
+    if getattr(context, 'cf_space', None):
+        if getattr(context, 'cf_delete_space_on_teardown', False):
             cf.delete_space(context.cf_space)
         else:
             context.log.info(
diff --git a/steps/browser_steps.py b/steps/browser_steps.py
index c1ec897e..ccbba34b 100644
--- a/steps/browser_steps.py
+++ b/steps/browser_steps.py
@@ -2,11 +2,19 @@
 
 import mechanicalsoup
 import requests
+import urllib3
 from behave import *
 
 from pysteel import command, dns
 
 
+def _get_verify(context):
+    skip_ssl = getattr(context.options.cf, 'skip_ssl_validation', False)
+    if skip_ssl:
+        urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
+    return not skip_ssl
+
+
 @when(u'you get {url}')
 def step_impl(context, url):
     """
@@ -16,6 +24,7 @@ def step_impl(context, url):
     url = dns.resolve_url(context, url)
     context.log.info('getting url {}'.format(url))
     context.browser = mechanicalsoup.StatefulBrowser()
+    context.browser.session.verify = _get_verify(context)
     attempt = 0
     while True:
         attempt += 1
@@ -41,10 +50,11 @@ def step_impl(context, url):
     url = dns.resolve_url(context, url)
     token = get_oauth_token(context)
     context.log.info('getting url {} using the CloudFoundry OAuth token'.format(url))
+    verify = _get_verify(context)
     attempt = 0
     while True:
         attempt += 1
-        resp = requests.get(url, headers={'Authorization': token})
+        resp = requests.get(url, headers={'Authorization': token}, verify=verify)
         if resp.status_code < 500:
             context.log.info('GET {} [{}]'.format(url, resp.status_code))
             resp.status_code.should.equal(200)
@@ -69,6 +79,7 @@ def step_impl(context, data, url):
     payload = {fields[0]: fields[1]}
     context.log.info('posting url {} {}'.format(url, payload))
     context.browser = mechanicalsoup.StatefulBrowser()
+    context.browser.session.verify = _get_verify(context)
     resp = context.browser.post(url, data=payload)
     context.log.info('POST {} [{}]'.format(url, resp.status_code))
 
@@ -120,7 +131,8 @@ def step_impl(context, app):
     """
     url = dns.resolve_url(context, 'https://{}/cloudfoundryapplication'.format(app))
     token = get_oauth_token(context)
-    resp = requests.get(url, headers={'Authorization': token})
+    verify = _get_verify(context)
+    resp = requests.get(url, headers={'Authorization': token}, verify=verify)
     resp.status_code.should.equal(200)
     # context.log.info(resp.content)
     for endpoint in ['beans', 'dbmigrations', 'env', 'health', 'heapdump', 'httpexchanges', 'info', 'loggers', 'mappings', 'prometheus', 'refresh', 'threaddump']:
@@ -134,10 +146,11 @@ def step_impl(context, app):
     """
     url = dns.resolve_url(context, 'https://{}/cloudfoundryapplication/health'.format(app))
     token = get_oauth_token(context)
+    verify = _get_verify(context)
     attempt = 0
     while True:
         attempt += 1
-        resp = requests.get(url, headers={'Authorization': token})
+        resp = requests.get(url, headers={'Authorization': token}, verify=verify)
         if resp.status_code < 500:
             context.log.info('GET {} [{}]'.format(url, resp.status_code))
             resp.status_code.should.equal(200)
diff --git a/user.ini.example b/user.ini.example
index bb6a6844..a328ec71 100644
--- a/user.ini.example
+++ b/user.ini.example
@@ -29,6 +29,11 @@
 ; ----------------------------------------------------------------------------
 ; cf_space = myspace
 
+; ----------------------------------------------------------------------------
+; whether to skip SSL certificate validation when logging into Cloud Foundry
+; ----------------------------------------------------------------------------
+; cf_skip_ssl_validation = no
+
 ; ----------------------------------------------------------------------------
 ; set these to <0 to wait ad infinitum
 ; ----------------------------------------------------------------------------