docs(run-a-node): note the installer auto-provisions local HTTPS trust

docs/run-a-node/local-https.md

@@ -29,11 +29,11 @@ Because the endpoint lives entirely on your machine's loopback, using it needs a
 - **The same content, the same routes.** `https://dig.local` serves exactly what the plain-`http` endpoint does — the store content, the health check, and verification — so nothing about how you use your node changes.
 - **A trusted padlock, no warnings.** Once the certificate is trusted, the browser treats `https://dig.local` like any other secure site — no scary certificate warning to click through.
 
-## On Windows, the installer trusts it for you
+## The installer provisions local HTTPS trust automatically
 
-On Windows, the [DIG Installer](/docs/run-a-node/universal-installer) provisions the local certificate into the Windows trust store as part of installation, so your browsers trust `https://dig.local` automatically — there's nothing extra to do.
+When you install the DIG node via the [DIG Installer](/docs/run-a-node/universal-installer), it automatically sets up the local HTTPS certificate trust on your operating system. On **Windows**, the installer provisions the local certificate into the Windows trust store as part of installation, so your browsers trust `https://dig.local` automatically — there's nothing extra to do. On **macOS and Linux**, the endpoint is served the same way, and browsers trust it once the local certificate has been provisioned; until then HTTPS is best-effort and clients simply read over plain `http` instead (see [the fallback](#fallback) below).
 
-On macOS and Linux the endpoint is served the same way. Browsers trust it once the local certificate has been provisioned; until then HTTPS is best-effort and clients simply read over plain `http` instead (see [the fallback](#fallback) below).
+The trust that the installer establishes is **name-constrained** — the local certificate authority can only vouch for `dig.local`, `*.dig`, and your machine's loopback addresses (`127.0.0.0/8` and `::1`). This name constraint is critical to security: even if the local CA's key were ever exposed, it could never be used to impersonate any website on the public internet — its authority is confined to your machine and DIG names only. When you uninstall the DIG node, the installer removes this trusted local CA from your operating system, so the trust is completely cleaned up.
 
 ## The certificate is short-lived and self-managing
 

docs/run-a-node/universal-installer.md

@@ -145,7 +145,7 @@ dig-node open --json chia://<storeId>/
 
 The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md)
 
-On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
+The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
 
 ## An always-on service, verified after install
 

i18n/de/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md

@@ -145,7 +145,7 @@ dig-node open --json chia://<storeId>/
 
 The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md)
 
-On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
+The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
 
 ## An always-on service, verified after install
 

i18n/es/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md

@@ -145,7 +145,7 @@ dig-node open --json chia://<storeId>/
 
 The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md)
 
-On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
+The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
 
 ## An always-on service, verified after install
 

i18n/fr/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md

@@ -145,7 +145,7 @@ dig-node open --json chia://<storeId>/
 
 The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md)
 
-On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
+The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
 
 ## An always-on service, verified after install
 

i18n/hi/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md

@@ -145,7 +145,7 @@ dig-node open --json chia://<storeId>/
 
 The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md)
 
-On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
+The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
 
 ## An always-on service, verified after install
 

i18n/id/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md

@@ -145,7 +145,7 @@ dig-node open --json chia://<storeId>/
 
 The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md)
 
-On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
+The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
 
 ## An always-on service, verified after install
 

i18n/ja/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md

@@ -145,7 +145,7 @@ dig-node open --json chia://<storeId>/
 
 The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md)
 
-On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
+The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
 
 ## An always-on service, verified after install
 

i18n/ko/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md

@@ -145,7 +145,7 @@ dig-node open --json chia://<storeId>/
 
 The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md)
 
-On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
+The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
 
 ## An always-on service, verified after install
 

i18n/pt-BR/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md

@@ -145,7 +145,7 @@ dig-node open --json chia://<storeId>/
 
 The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md)
 
-On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
+The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
 
 ## An always-on service, verified after install
 

i18n/ru/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md

@@ -145,7 +145,7 @@ dig-node open --json chia://<storeId>/
 
 The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md)
 
-On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
+The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
 
 ## An always-on service, verified after install
 

i18n/tr/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md

@@ -145,7 +145,7 @@ dig-node open --json chia://<storeId>/
 
 The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md)
 
-On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
+The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
 
 ## An always-on service, verified after install
 

i18n/vi/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md

@@ -145,7 +145,7 @@ dig-node open --json chia://<storeId>/
 
 The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md)
 
-On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
+The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
 
 ## An always-on service, verified after install
 

i18n/zh-CN/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md

@@ -145,7 +145,7 @@ dig-node open --json chia://<storeId>/
 
 The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md)
 
-On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
+The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
 
 ## An always-on service, verified after install
 

i18n/zh-TW/docusaurus-plugin-content-docs/current/run-a-node/universal-installer.md

@@ -145,7 +145,7 @@ dig-node open --json chia://<storeId>/
 
 The installer registers **`dig.local`** for your machine so consumers on the same host resolve your node by name (`dig.local` → `localhost`) without hard-coding a port. This is what lets the [DIG Browser](../browser/chia-protocol.md) and extension prefer a local node automatically. → [Point a consumer at your node](./point-a-consumer.md)
 
-On Windows the installer also trusts your node's local HTTPS certificate, so browsers reach it securely at `https://dig.local`. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
+The installer also automatically sets up local HTTPS trust: it provisions a name-constrained local certificate authority (restricted to `dig.local`, `*.dig`, and loopback only) that your browser trusts, so you can reach your node securely at `https://dig.local` with a valid certificate. Uninstalling the node removes this trusted CA cleanly. → [The `https://dig.local` endpoint](/docs/run-a-node/local-https)
 
 ## An always-on service, verified after install
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "docs-dig-net",
-  "version": "0.11.3",
+  "version": "0.11.4",
   "private": true,
   "scripts": {
     "docusaurus": "docusaurus",