Remote access and TLS
access
Section titled “access”Remote access and TLS (first-run wizard v2 §S6). Serving the leaf certificate for download is UNAUTHENTICATED by design — a client that does not yet trust the certificate frequently cannot log in to fetch it — and discloses only the public half every TLS handshake already transmits. The admin diagnostics route carries the admin tag and the normal server-enforced gate.