CertZipDL

public/css/admin.css

@@ -415,3 +415,11 @@ pre.raw {
   max-height: 320px;
   overflow: auto;
 }
+
+/* The recommended download should not look identical to the two fallbacks. */
+.sys-actions .primary-link {
+  border-color: var(--deep);
+  background: var(--deep);
+  color: #fff;
+  font-weight: 600;
+}

public/js/admin.js

@@ -1434,8 +1434,9 @@ function renderTls(tls) {
       itself before it lapses, and devices that trust the authority keep working without being
       touched again.</p>
     <div class="sys-actions">
-      <a class="ghost" href="/admin/api/tls/ca.crt" download>CA certificate (.crt)</a>
-      <a class="ghost" href="/admin/api/tls/ca.cer" download>CA certificate (.cer, for Jamf and Apple)</a>
+      <a class="ghost primary-link" href="/admin/api/tls/ca-bundle.zip" download>Download all certificates (.zip)</a>
+      <a class="ghost" href="/admin/api/tls/ca.crt" download>.crt only</a>
+      <a class="ghost" href="/admin/api/tls/ca.cer" download>.cer only</a>
       <button class="ghost owner-only" id="renew-cert">Renew the server certificate</button>
       <button class="ghost danger owner-only" id="new-ca">Start a new authority</button>
     </div>`;