remint key when ip changes or if broken
Hunter
Sunday, October 25th, 2026 at 4:37 PM
221
222
223 def ensure_leaf_cert(local_ip):
- """Mint a cert/key for this machine's LAN IP (and localhost) if missing."""
224 + """Mint a cert/key for this machine's LAN IP (and localhost) if missing
225 + or minted for a different IP."""
226 CERT_DIR.mkdir(parents=True, exist_ok=True)
227 if CERT_FILE.exists() and KEY_FILE.exists():
- return
228 + try:
229 + sans = ssl._ssl._test_decode_cert(str(CERT_FILE)).get("subjectAltName", ())
230 + except (AttributeError, OSError):
231 + print("Couldn't read the existing certificate.")
232 + else:
233 + old_ips = [v for k, v in sans if k == "IP Address" and v != "127.0.0.1"]
234 + if local_ip in old_ips:
235 + return
236 + print(f"This machine's LAN IP changed ({', '.join(old_ips)} → {local_ip}).")
237 print(f"Minting certificate for {local_ip}...")
238 subprocess.check_call([
239 "mkcert",