Section 8 of 13
Certificate and browser warning
Why the browser warns you on the first visit, and three ways to make it stop.
The panel runs over HTTPS, so the device needs a certificate. The key it rests on is created inside the device on first start and NEVER leaves it — only a signing request ever goes out.
Three sources of certificate
- Its own, self-signed
- The factory state. The browser warns, because nobody outside vouches for the device identity. You establish trust once: compare the fingerprint shown by the browser with the one in the device panel.
- From the certificate service
- The device fetches a certificate that browsers accept and the warning disappears. Requires internet access. The panel then shows the address at which the device is reachable without warnings.
- Signed by your own authority
- For companies running their own PKI. You download the request from the panel, sign it with your authority and upload the finished chain back.
An uploaded certificate has to match the device key, which means it has to come from the device request. A certificate issued for a different key is refused with a clear message — without that, one copy-paste mistake would cut off the panel until a reset.
If a certificate from the service expires while the service happens to be unreachable, the device falls back to its own, self-signed one. A browser warning is better than a locked-out panel.