From 14bd9ba07e2d47645289e9d863872ba525b19f08 Mon Sep 17 00:00:00 2001 From: Michael Taylor Date: Wed, 5 Aug 2026 00:23:11 +0000 Subject: [PATCH 1/2] docs(run-a-node): note the installer auto-provisions local HTTPS trust Document that the DIG installer automatically sets up local HTTPS certificate trust on installation, with a name-constrained CA (dig.local, .dig, loopback), and removes it cleanly on uninstall. This covers Windows, macOS, and Linux. Co-Authored-By: Claude --- docs/run-a-node/local-https.md | 6 +++--- docs/run-a-node/universal-installer.md | 2 +- package.json | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/run-a-node/local-https.md b/docs/run-a-node/local-https.md index 6398feb..b7e9d12 100644 --- a/docs/run-a-node/local-https.md +++ b/docs/run-a-node/local-https.md @@ -29,11 +29,11 @@ Because the endpoint lives entirely on your machine's loopback, using it needs a - **The same content, the same routes.** `https://dig.local` serves exactly what the plain-`http` endpoint does — the store content, the health check, and verification — so nothing about how you use your node changes. - **A trusted padlock, no warnings.** Once the certificate is trusted, the browser treats `https://dig.local` like any other secure site — no scary certificate warning to click through. -## On Windows, the installer trusts it for you +## The installer provisions local HTTPS trust automatically -On Windows, the [DIG Installer](/docs/run-a-node/universal-installer) provisions the local certificate into the Windows trust store as part of installation, so your browsers trust `https://dig.local` automatically — there's nothing extra to do. +When you install the DIG node via the [DIG Installer](/docs/run-a-node/universal-installer), it automatically sets up the local HTTPS certificate trust on your operating system. On **Windows**, the installer provisions the local certificate into the Windows trust store as part of installation, so your browsers trust `https://dig.local` automatically — there's nothing extra to do. On **macOS and Linux**, the endpoint is served the same way, and browsers trust it once the local certificate has been provisioned; until then HTTPS is best-effort and clients simply read over plain `http` instead (see [the fallback](#fallback) below). -On macOS and Linux the endpoint is served the same way. Browsers trust it once the local certificate has been provisioned; until then HTTPS is best-effort and clients simply read over plain `http` instead (see [the fallback](#fallback) below). +The trust that the installer establishes is **name-constrained** — the local certificate authority can only vouch for `dig.local`, `*.dig`, and your machine's loopback addresses (`127.0.0.0/8` and `::1`). This name constraint is critical to security: even if the local CA's key were ever exposed, it could never be used to impersonate any website on the public internet — its authority is confined to your machine and DIG names only. When you uninstall the DIG node, the installer removes this trusted local CA from your operating system, so the trust is completely cleaned up. ## The certificate is short-lived and self-managing diff --git a/docs/run-a-node/universal-installer.md b/docs/run-a-node/universal-installer.md index 1694805..6b34f2c 100644 --- a/docs/run-a-node/universal-installer.md +++ b/docs/run-a-node/universal-installer.md @@ -145,7 +145,7 @@ dig-node open --json chia:/// The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md) -On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) +The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) ## An always-on service, verified after install diff --git a/package.json b/package.json index 27963c2..09fc676 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "docs-dig-net", - "version": "0.11.3", + "version": "0.11.4", "private": true, "scripts": { "docusaurus": "docusaurus", From 82cc9b32495fe029a0855627a816606cfa1517d5 Mon Sep 17 00:00:00 2001 From: Michael Taylor Date: Wed, 5 Aug 2026 00:34:30 +0000 Subject: [PATCH 2/2] docs(i18n): re-sync install-page locale copies with the English source MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The install-path-lint enforces that every locale copy of an install page is byte-identical to its English source (the tree materializes untranslated English copies; a drifted copy would serve a stranger a stale command). The universal-installer.md edit left its 13 i18n copies drifted — re-sync them. Co-Authored-By: Claude --- .../current/run-a-node/universal-installer.md | 2 +- .../current/run-a-node/universal-installer.md | 2 +- .../current/run-a-node/universal-installer.md | 2 +- .../current/run-a-node/universal-installer.md | 2 +- .../current/run-a-node/universal-installer.md | 2 +- .../current/run-a-node/universal-installer.md | 2 +- .../current/run-a-node/universal-installer.md | 2 +- .../current/run-a-node/universal-installer.md | 2 +- .../current/run-a-node/universal-installer.md | 2 +- .../current/run-a-node/universal-installer.md | 2 +- .../current/run-a-node/universal-installer.md | 2 +- .../current/run-a-node/universal-installer.md | 2 +- .../current/run-a-node/universal-installer.md | 2 +- 13 files changed, 13 insertions(+), 13 deletions(-) diff --git a/i18n/de/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md b/i18n/de/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md index 1694805..6b34f2c 100644 --- a/i18n/de/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md +++ b/i18n/de/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md @@ -145,7 +145,7 @@ dig-node open --json chia:/// The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md) -On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) +The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) ## An always-on service, verified after install diff --git a/i18n/es/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md b/i18n/es/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md index 1694805..6b34f2c 100644 --- a/i18n/es/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md +++ b/i18n/es/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md @@ -145,7 +145,7 @@ dig-node open --json chia:/// The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md) -On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) +The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) ## An always-on service, verified after install diff --git a/i18n/fr/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md b/i18n/fr/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md index 1694805..6b34f2c 100644 --- a/i18n/fr/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md +++ b/i18n/fr/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md @@ -145,7 +145,7 @@ dig-node open --json chia:/// The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md) -On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) +The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) ## An always-on service, verified after install diff --git a/i18n/hi/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md b/i18n/hi/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md index 1694805..6b34f2c 100644 --- a/i18n/hi/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md +++ b/i18n/hi/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md @@ -145,7 +145,7 @@ dig-node open --json chia:/// The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md) -On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) +The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) ## An always-on service, verified after install diff --git a/i18n/id/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md b/i18n/id/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md index 1694805..6b34f2c 100644 --- a/i18n/id/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md +++ b/i18n/id/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md @@ -145,7 +145,7 @@ dig-node open --json chia:/// The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md) -On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) +The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) ## An always-on service, verified after install diff --git a/i18n/ja/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md b/i18n/ja/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md index 1694805..6b34f2c 100644 --- a/i18n/ja/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md +++ b/i18n/ja/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md @@ -145,7 +145,7 @@ dig-node open --json chia:/// The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md) -On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) +The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) ## An always-on service, verified after install diff --git a/i18n/ko/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md b/i18n/ko/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md index 1694805..6b34f2c 100644 --- a/i18n/ko/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md +++ b/i18n/ko/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md @@ -145,7 +145,7 @@ dig-node open --json chia:/// The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md) -On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) +The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) ## An always-on service, verified after install diff --git a/i18n/pt-BR/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md b/i18n/pt-BR/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md index 1694805..6b34f2c 100644 --- a/i18n/pt-BR/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md +++ b/i18n/pt-BR/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md @@ -145,7 +145,7 @@ dig-node open --json chia:/// The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md) -On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) +The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) ## An always-on service, verified after install diff --git a/i18n/ru/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md b/i18n/ru/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md index 1694805..6b34f2c 100644 --- a/i18n/ru/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md +++ b/i18n/ru/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md @@ -145,7 +145,7 @@ dig-node open --json chia:/// The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md) -On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) +The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) ## An always-on service, verified after install diff --git a/i18n/tr/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md b/i18n/tr/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md index 1694805..6b34f2c 100644 --- a/i18n/tr/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md +++ b/i18n/tr/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md @@ -145,7 +145,7 @@ dig-node open --json chia:/// The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md) -On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) +The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) ## An always-on service, verified after install diff --git a/i18n/vi/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md b/i18n/vi/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md index 1694805..6b34f2c 100644 --- a/i18n/vi/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md +++ b/i18n/vi/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md @@ -145,7 +145,7 @@ dig-node open --json chia:/// The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md) -On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) +The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) ## An always-on service, verified after install diff --git a/i18n/zh-CN/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md b/i18n/zh-CN/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md index 1694805..6b34f2c 100644 --- a/i18n/zh-CN/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md +++ b/i18n/zh-CN/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md @@ -145,7 +145,7 @@ dig-node open --json chia:/// The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md) -On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) +The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) ## An always-on service, verified after install diff --git a/i18n/zh-TW/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md b/i18n/zh-TW/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md index 1694805..6b34f2c 100644 --- a/i18n/zh-TW/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md +++ b/i18n/zh-TW/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md @@ -145,7 +145,7 @@ dig-node open --json chia:/// The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md) -On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) +The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https) ## An always-on service, verified after install