The TLS certificate PCs see when they connect to this site, whether it is served by IIS or by the Docker stack. Its public key pin goes into the Set-ShopDBServerPins.ps1 entry, and the certificate itself into the trusted root entry for agents older than 1.20.
{{ cert.subject_cn }}
{{ cert.san_list.join(', ') }}
{{ formatDate(cert.not_before) }}
{{ formatDate(cert.not_after) }} ({{ cert.expires_in_days }} days remaining) (EXPIRED {{ Math.abs(cert.expires_in_days) }} days ago)
{{ cert.thumbprint }}
Use this value for ServerCertThumbprint in agent appsettings.json to enable certificate pinning (prevents MITM attacks).
{{ cert.spkisha256 }}
Not reported by this server.
Paste this into the GE-Enforce Set-ShopDBServerPins.ps1 entry (-Pins) so agents 1.20 and later trust only this server's key. It survives a renewal that keeps the same private key.
{{ cert.issuer }}
Self-signedNo certificate file found at certs/server.crt
Connects to this site's base URL and reads the certificate it presents, the way a PC does. An IIS binding or a proxy in front of the app can present a different certificate than the file above.
Checking {{ live?.url || 'the site address' }}...
No site base URL is set (site_base_url, under Settings, Email / SMTP, or in the setup wizard), so there is no address to check.
Checked {{ live.url }}
{{ live.error }}
{{ live.presentedspkisha256 }}
Matches the pin of the certificate file above.
Create a new self-signed certificate for development or air-gapped sites. The certificate will be valid for 1 year (365 days).
Hostname or IP that agents use to connect (e.g., shopdb.example.com or 192.168.100.1)
Comma-separated list: DNS:hostname or IP:address (e.g., DNS:localhost,IP:192.168.100.1,DNS:shopdb.local)
Certificate lifetime (recommended: 365 for self-signed)
Upload a certificate from a trusted CA or internal PKI. You must provide both the certificate (.crt or .pem) and private key (.key).
PEM-encoded certificate (.crt or .pem)
PEM-encoded private key (.key or .pem, unencrypted)
To prevent MITM attacks with self-signed certificates, configure agents to validate the server certificate thumbprint:
{
"ServerCertThumbprint": "AA:BB:CC:..."
}
Important: When you renew the server certificate, you must update ServerCertThumbprint on all agents before the old certificate expires, or agents will reject connections.
For air-gapped sites, generate the certificate on the work PC and include it in the deployment bundle: