diff --git a/stable/spinnaker/Chart.yaml b/stable/spinnaker/Chart.yaml
index b7cf745211..61f1137f93 100644
--- a/stable/spinnaker/Chart.yaml
+++ b/stable/spinnaker/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v1
 description: Open source, multi-cloud continuous delivery platform for releasing software changes with high velocity and confidence.
 name: spinnaker
-version: 1.13.4
+version: 1.14.0
 appVersion: 1.12.5
 home: http://spinnaker.io/
 sources:
diff --git a/stable/spinnaker/README.md b/stable/spinnaker/README.md
index cf28ee39f6..8a7f6947e7 100644
--- a/stable/spinnaker/README.md
+++ b/stable/spinnaker/README.md
@@ -96,6 +96,37 @@ Spinnaker supports [many](https://www.spinnaker.io/setup/install/storage/) persi
 * Redis
 * AWS S3
 
+## Use custom `cacerts`
+
+In environments with air-gapped setup, especially with internal tooling (repos) and self-signed certificates it is required to provide an adequate `cacerts` which overrides the default one:
+
+1. Create a yaml file `cacerts.yaml` with a secret that contanins the `cacerts`
+
+   ```yaml
+   apiVersion: v1
+   kind: Secret
+   metadata:
+     name: custom-cacerts
+   data:
+     cacerts: |
+       xxxxxxxxxxxxxxxxxxxxxxx
+   ```
+
+2. Upload your `cacerts.yaml` to a secret with the key you specify in `secretName` in the cluster you are installing Spinnaker to.
+
+   ```shell
+   $ kubectl apply -f cacerts.yaml
+   ```
+
+3. Set the following values of the chart:
+
+   ```yaml
+   customCerts:
+      ## Enable to override the default cacerts with your own one
+      enabled: false
+      secretName: custom-cacerts
+   ```
+
 ## Customizing your installation
 
 ### Manual
diff --git a/stable/spinnaker/templates/statefulsets/halyard.yaml b/stable/spinnaker/templates/statefulsets/halyard.yaml
index 87fbc88421..572b6eb30c 100644
--- a/stable/spinnaker/templates/statefulsets/halyard.yaml
+++ b/stable/spinnaker/templates/statefulsets/halyard.yaml
@@ -46,6 +46,11 @@ spec:
           mountPath: /tmp/additionalProfileConfigMaps
         - name: halyard-initscript
           mountPath: /tmp/initscript
+        {{- if .Values.halyard.customCerts.enabled }}
+        - mountPath: /etc/ssl/certs/java/cacerts
+          subPath: cacerts
+          name: cacerts
+        {{- end }}
       volumes:
       {{- if .Values.kubeConfig.enabled }}
       - name: kube-config
@@ -66,7 +71,7 @@ spec:
           {{- if .Values.dockerRegistryAccountSecret }}
           secretName: {{ .Values.dockerRegistryAccountSecret }}
           {{- else }}
-          secretName: {{ template "spinnaker.fullname" .}}-registry
+          secretName: {{ template "spinnaker.fullname" . }}-registry
           {{- end }}
       {{- if and .Values.s3.enabled .Values.s3.accessKey .Values.s3.secretKey }}
       - name: s3-secrets
@@ -102,6 +107,14 @@ spec:
       - name: halyard-initscript
         configMap:
           name: {{ template "spinnaker.fullname" . }}-halyard-init-script
+      {{- if .Values.halyard.customCerts.enabled }}
+      - name: cacerts
+        secret:
+          secretName: {{ .Values.halyard.customCerts.secretName }}
+          items:
+          - key: cacerts
+            path: cacerts
+      {{- end }}
       containers:
       - name: halyard
         image: {{ .Values.halyard.image.repository }}:{{ .Values.halyard.image.tag }}
@@ -143,6 +156,11 @@ spec:
         env:
 {{ toYaml .Values.halyard.env | indent 8 }}
         {{- end }}
+        {{- if .Values.halyard.customCerts.enabled }}
+        - mountPath: /etc/ssl/certs/java/cacerts
+          subPath: cacerts
+          name: cacerts
+        {{- end }}
   volumeClaimTemplates:
   - metadata:
       name: halyard-home
diff --git a/stable/spinnaker/values.yaml b/stable/spinnaker/values.yaml
index cb0cb13759..912b425db7 100644
--- a/stable/spinnaker/values.yaml
+++ b/stable/spinnaker/values.yaml
@@ -75,6 +75,10 @@ halyard:
   # env:
   #   - name: DEFAULT_JVM_OPTS
   #     value: -Dhttp.proxyHost=proxy.example.com
+  customCerts:
+    ## Enable to override the default cacerts with your own one
+    enabled: false
+    secretName: custom-cacerts
 
 # Define which registries and repositories you want available in your
 # Spinnaker pipeline definitions