Cert Fixes

README.md

@@ -271,9 +271,25 @@ HOST_PORT=8443
 HTTPS_PUBLIC_PORT=8443
 ```
 
-An address that isn't listed produces a browser warning. Change the list and restart; the
-certificate reissues itself automatically, and devices that already trust the authority accept
-it without any further work.
+An address that isn't listed produces a browser warning.
+
+After changing anything in `.env`, bring the container back with **`docker compose up -d`**, not
+`docker compose restart`. Restart reuses the running container along with the environment it
+started with, so the edit appears to do nothing; `up -d` recreates it and picks the new values
+up. Confirm with:
+
+```bash
+docker compose exec visitor-signin printenv HTTPS_HOSTNAMES
+docker compose logs --tail=20 visitor-signin | grep tls
+```
+
+The log should say `renewing the server certificate: HTTPS_HOSTNAMES changed` and then list every
+name it now covers. If it lists only `localhost`, `visitors.local` and a `172.x` address, the
+variable never reached the container — those are the defaults plus the container's own docker
+bridge address.
+
+Reissuing does **not** touch the certificate authority, so devices that already trust it keep
+working and no MDM profile needs redeploying.
 
 The kiosk is then at `https://visitors.local:8443`, admin at `https://visitors.local:8443/admin`.