Setting Up the Local HTTPS Certificate

DiKAS protects the connection in the business network with its own site certificate. Every business has its own certificate authority (CA). Before a browser opens the permanent address https://dikas-<SystemId>.local without a warning, the device must trust this CA once. This is only needed once per device.

Two ways to the certificate

Page	Address	Purpose
Setup page	http://<LAN-IP>/zertifikat	Step by step with QR code, shortened fingerprint and HTTPS test
Download page	http://<LAN-IP>/installcerts	All files for all devices, full fingerprint, Windows installation script, everything as a ZIP

Both pages are reachable without login from any device in the business network. They only hand out the public certificate of the site CA, never a secret key. The LAN IP and the QR code are shown by the main POS in DikasArch under Certificates.

The download page provides:

File	For
dikas-zertifikate.zip	Everything together including a short guide (LIESMICH.txt) – handy for passing on or for several PCs
dikas-ca-installieren.cmd	Windows: installs the certificate with a double-click (guide)
dikas-local-ca.cer	Windows: certificate for manual installation
dikas-local-ca.mobileconfig	iPhone, iPad and Mac (guide)
dikas-local-ca.crt	Android (guide), Linux and all other devices

Start the setup

1. Connect the device to the business Wi-Fi or LAN.
2. On the main POS, open Certificates in DikasArch.
3. Scan the QR code or open http://<displayed LAN IP>/zertifikat or http://<displayed LAN IP>/installcerts on the end device.
4. Compare the displayed SHA-256 fingerprint with the main POS.
5. Follow the guide for Apple, Windows or Android.
6. On the setup page, run the HTTPS test for the permanent address https://dikas-<SystemId>.local.

Always compare the fingerprint

Only confirm or install a CA if the fingerprint matches the display on the main POS. The main POS and the setup page show the first groups of characters, the download page shows the full value – compare at least the displayed groups. A changed fingerprint is never adopted silently.

The "Certificates" page on the main POS

In DikasArch under Certificates you see:

• Mode and Business / site – which business the CA belongs to,
• CA fingerprint and server fingerprint,
• CA valid until and server valid until,
• Main address (dikas-<SystemId>.local), LAN IP and all names and addresses for which the server certificate is valid (SANs).

The buttons: Setup & QR code opens the setup page, Download CA downloads the certificate directly, All downloads (/installcerts) opens the download page, Test HTTPS calls the permanent address, and Check now compares the certificate immediately instead of waiting for the automatic check (for example after a change of IP address).

Notes at the top of the page:

• "This business's CA has changed" – all end devices must deliberately confirm the new fingerprint (see CA change).
• "The site CA has at most two years of remaining validity" – the switch to a new CA must be planned. Contact DiKAS support.
• "The server certificate is being renewed" – runs automatically, nothing to do on the end devices.

Other devices and browsers

Firefox uses its own certificate list, depending on the setting. If Firefox still shows a warning although the operating system trusts the CA: Settings → Privacy & Security → View Certificates → Authorities → Import, choose the file dikas-local-ca.crt and tick "Trust this CA to identify websites".

Linux: Download dikas-local-ca.crt and place it as administrator:

• Debian/Ubuntu: to /usr/local/share/ca-certificates/, then sudo update-ca-certificates
• Arch: to /etc/ca-certificates/trust-source/anchors/, then sudo trust extract-compat
• Fedora: to /etc/pki/ca-trust/source/anchors/, then sudo update-ca-trust

Chrome and Chromium on Linux partly use their own list: Settings → Privacy and security → Security → Manage certificates → Authorities → Import.

Several businesses

Several site CAs may be stored on one device at the same time. The native DiKAS client stores trust separately per business. Adding another business does not replace existing entries.

CA change

If an already known business later reports a different CA, DiKAS shows the old and new fingerprint. Clarify the change at the main POS and either confirm it explicitly or cancel. Afterwards install the new CA on the end devices exactly as the first time. Only remove an old CA once no device needs to reach this business through it any more.

Validity periods

The site CA is valid for ten years. The short-lived server certificates are valid for 90 days and are renewed automatically by DiKAS – also immediately when the IP address or the name of the POS changes. For these normal renewals the CA does not have to be reinstalled on the end devices.

If it does not work

What you see	What to do
Browser reports "Your connection is not private" / "Certificate not trusted"	The CA is not yet installed on this device or not marked as trusted. Go through the guide for the device again; on iOS enable full trust.
Warning only in Firefox	Additionally import the certificate in Firefox (see above, "Other devices and browsers").
Warning despite installed CA	The device may know an old CA of this business. Compare the fingerprint and install the current CA (see CA change).
https://dikas-<SystemId>.local does not open at all	The device is not in the business network or does not resolve .local names. Test with the LAN IP: https://<LAN-IP>/.
The page reports "The site CA is being prepared"	Normal shortly after the POS starts. Reload the page after a minute.
Windows script reports "dikas-local-ca.cer is missing"	The ZIP was not extracted. First Extract all, then start the script in the extracted folder.