95802947dd
Firefox rejected the self-signed cert because: 1. The issuer was a wildcard CN (not a valid CA) 2. Trust flags were C,, (not CT,,) Now generates a proper chain: - ca.crt/ca.key — CA with CN="Homelab CA, O=fhirworx" - homelab.crt/key — server cert signed by CA with SAN wildcard install_certs.sh updated to import ca.crt with CT,, flags.