Feature

A certificate that does not rot

in this fork since v2.23.0

Stock firmware serves a certificate no browser will accept, valid for thirty days, and never replaces it. This one is named after the board, renews itself, and will not overwrite yours.

825days of validity, renewed 30 days before it ends

5key types served, each proved by a real handshake

0certificates it will overwrite that it did not issue

the daemon's certificate path, with a real handshake per key type, 2026-09-12.

See it in the demo →The Security page, with the certificate the board serves.Do it on your board →Install the firmware that issues it.The evidence →Including the console's certificate requirement.Who may reach this board →The other half of the board's access story.

The Security page: the certificate the board serves, who issued it, its key and when it expires. On stock firmware no browser would accept the certificate in front of it.

The argument

An expired self-signed certificate teaches operators to click through warnings, which is the habit that makes every later certificate meaningless. This one carries the board's real names, renews itself 30 days out, and refuses to replace a certificate it did not issue -- so installing your own is safe.

The full argument, with every measurement →