Add TLS warning for private CA certs

enterprise/quick-start.mdx

@@ -43,6 +43,13 @@
     <Card title="OpenHands AWS Terraform Module" icon="github" href="https://github.com/All-Hands-AI/OpenHands-Cloud/tree/main/terraform/aws">
       Follow the README instructions to configure and apply the Terraform configuration.
     </Card>
+
+    <Warning>
+      The recommended Terraform path provisions a publicly trusted TLS certificate. If you bring
+      your own certificate instead, use a publicly trusted CA whenever possible. Private CA
+      certificates require every external webhook or OAuth provider that calls OpenHands to trust
+      your CA.
+    </Warning>
   </Tab>
 
   <Tab title="Manual VM Setup">
@@ -183,9 +190,9 @@
 done
 ```
 
 Expected: each hostname above resolves to your VM's public IP address.
 
 Test that a runtime wildcard hostname resolves:
 
 ```bash
 getent hosts "test.runtime.${BASE_DOMAIN}" || nslookup "test.runtime.${BASE_DOMAIN}"
@@ -220,7 +227,7 @@
 done
 ```
 
 Any HTTP response code other than `000` is acceptable for reachability checks
 (for example `200`, `301`, `302`, `401`, `403`, `405`).
 
 If any check fails, stop and resolve before continuing:
@@ -231,10 +238,10 @@
 
 | Requirement | Why It Exists |
 |------------|----------------|
 | `443/TCP` inbound | Primary HTTPS entrypoint for users and service hostnames |
 | `30000/TCP` inbound | Replicated/KOTS Admin Console for install and configuration |
 | `80/TCP` inbound | HTTP entrypoint used for ingress/redirect behavior |
 | `*.runtime.<domain>` DNS + cert SAN | Runtime sandboxes are addressed by dynamic runtime-specific hostnames |
 | `replicated.app`, `proxy.replicated.com` | Replicated control-plane/license/install paths |
 | `images.r9...`, `charts.r9...`, `updates.r9...`, `install.r9...` | Vendor distribution image/chart/update/install endpoints |
 | `traefik.github.io` | Embedded cluster ingress chart repository |
@@ -282,6 +289,11 @@
   If you provisioned manually and have your own certificates on the VM, pass them the same way.
   You can also omit the `--tls-cert` and `--tls-key` flags and upload certificates later through
   the Admin Console.
+
+  For trials and production deployments, use a publicly trusted TLS certificate whenever possible.
+  Private CA certificates may work for users after manual trust setup, but external integrations
+  such as GitHub, GitLab, Slack, Jira, and Bitbucket must also trust the certificate chain. If they
+  do not, webhook or OAuth callbacks can fail TLS verification and repeatedly retry.
 </Warning>
 
 ![Installation commands](./images/install-commands.png)
@@ -300,8 +312,11 @@
 ### 5. Upload TLS certificate (if not provided with the install command)
 
 If you did not provide certificates with the `install` command, select **"Upload your own"**,
 enter your base domain under **Hostname**, upload your private key and SSL certificate, then click **Continue**.
 
+If you upload a private CA certificate, make sure any external webhook or OAuth provider that
+calls OpenHands also trusts that CA.
+
 ![Upload TLS certificate](./images/upload-tls-certificate.png)
 
 ### 6. Log in to the Admin Console
@@ -325,7 +340,7 @@
 
 ### Domain Configuration
 
 - Select **"Derive hostnames from domain (recommended)"**
 - Enter your base domain (e.g., `openhands.example.com`)
 
 ### Certificate Configuration
@@ -366,7 +381,7 @@
 
 ### Additional Integrations
 
 If your team uses Jira Data Center or Bitbucket Data Center, follow these guides
 to configure Admin Console values before deployment and complete webhook setup
 inside OpenHands after deployment.
 
@@ -375,7 +390,7 @@
     Configure Bitbucket Data Center login, repository access, bot identity, and pull request webhooks.
   </Card>
   <Card title="Jira Data Center" icon="building" href="/enterprise/integrations/jira-data-center">
     Configure Jira issue triggers, OAuth account linking, service account credentials, and Jira webhooks.
   </Card>
 </CardGroup>