Cert Fix

src/tls.js

@@ -17,7 +17,9 @@ import { createZip } from './zip.js';
  */
 
 const CA_DAYS = 3650;
-const SERVER_DAYS = 398;
+// Apple rejects a TLS server certificate whose validity exceeds 398 days. Exactly
+// 398 sits on the line with no room for rounding or clock skew, so leave a margin.
+const SERVER_DAYS = 396;
 const RENEW_WITHIN_DAYS = 30;
 
 function certDir() {