Cert Fix

.claude-context/00-overview.md

@@ -25,16 +25,10 @@ console. A Google Sheet mirrors who is currently on site for evacuation roll cal
 - Check what's deployed: `docker compose exec visitor-signin npm run version`.
 - Printing diagnostics: `docker compose exec visitor-signin node scripts/print-test.mjs`.
 
-## Branches
-- `deploy` — live branch (this one).
-- `feature/native-ql-protocol` — unmerged native Node QL printing stack; see the 2026-09-07 session before merging.
-- `main` — stale since 2026-09-07.
-
 ## Where to look
 - `01-architecture.md` — current design and the reasoning behind it.
 - `sessions/` — dated session records.
 - `README.md` in the repo root — operator documentation.
 
 ## Session Log
-- 2026-09-07 — Native Brother QL Protocol (replacing brother_ql subprocess) — Built native raster/TCP print modules and photo dithering on a feature branch; tested, not yet merged into deploy.
 - 2026-09-23 — Visitor sign-in kiosk: build, HTTPS, and server-side label printing — Built the app end to end; added multi-site, 2FA admin accounts, self-signed CA for Jamf-managed iPads, server-side QL-820NWB printing (found `--red` is mandatory on DK-22251), single-tab evacuation sheet, branding, and photo halftoning.

.claude-context/sessions/2026-09-23-visitor-kiosk-build.md

@@ -200,3 +200,25 @@ leave a stale lockout.
 
 **Files:** `src/routes/admin.js` (PATCH handler), `public/js/admin.js` (edit modal shows the
 current PIN, relabelled field, shows the card after a change), `public/css/admin.css`, `README.md`.
+
+---
+
+## Addendum — iPad trust troubleshooting
+
+Reported: Safari and Chrome on a Jamf-managed iPad still report an insecure connection after the
+certificate was imported into Jamf.
+
+**Found:** the server certificate was being issued for *exactly* 398 days — Apple's ceiling, with
+zero margin for rounding or clock skew. `SERVER_DAYS` in `src/tls.js` reduced 398 → 396.
+
+**Added:** `scripts/tls-check.mjs` (`npm run tls-check`), which connects to a given URL and checks
+what iOS requires: address covered by a SAN, validity span, SAN present, `serverAuth` EKU,
+signature algorithm, key size, and that the served leaf was issued by this server's CA. It prints
+the authority and leaf fingerprints side by side.
+
+Note: Node's `X509Certificate` does not expose extended key usage and `toString()` returns PEM,
+so the EKU and signature checks shell out to `openssl x509 -noout -text`.
+
+**Most likely causes, still unconfirmed on the device:** the *served* certificate was uploaded to
+Jamf instead of the *authority*; or the address the iPad uses is not in `HTTPS_HOSTNAMES` (the
+host `.env` was previously missing that line entirely).