Cert Fix

.claude-context/sessions/2026-09-23-visitor-kiosk-build.md

@@ -200,3 +200,25 @@ leave a stale lockout.
 
 **Files:** `src/routes/admin.js` (PATCH handler), `public/js/admin.js` (edit modal shows the
 current PIN, relabelled field, shows the card after a change), `public/css/admin.css`, `README.md`.
+
+---
+
+## Addendum — iPad trust troubleshooting
+
+Reported: Safari and Chrome on a Jamf-managed iPad still report an insecure connection after the
+certificate was imported into Jamf.
+
+**Found:** the server certificate was being issued for *exactly* 398 days — Apple's ceiling, with
+zero margin for rounding or clock skew. `SERVER_DAYS` in `src/tls.js` reduced 398 → 396.
+
+**Added:** `scripts/tls-check.mjs` (`npm run tls-check`), which connects to a given URL and checks
+what iOS requires: address covered by a SAN, validity span, SAN present, `serverAuth` EKU,
+signature algorithm, key size, and that the served leaf was issued by this server's CA. It prints
+the authority and leaf fingerprints side by side.
+
+Note: Node's `X509Certificate` does not expose extended key usage and `toString()` returns PEM,
+so the EKU and signature checks shell out to `openssl x509 -noout -text`.
+
+**Most likely causes, still unconfirmed on the device:** the *served* certificate was uploaded to
+Jamf instead of the *authority*; or the address the iPad uses is not in `HTTPS_HOSTNAMES` (the
+host `.env` was previously missing that line entirely).