diff --git a/.gitignore b/.gitignore
index e34f211..9b3f806 100644
--- a/.gitignore
+++ b/.gitignore
@@ -18,6 +18,14 @@ test-results/
 .env
 .env.production
 
+# certificates / keys (never commit)
+*.crt
+*.key
+*.pem
+*.pfx
+*.p12
+caddy-local-root.crt
+
 # macOS-specific files
 .DS_Store