DC-147: named root CA with critical name constraints, leaf compliance assertions, install-page hardening, encrypted backup + tests

ca/index.html

@@ -764,6 +764,23 @@
                 Installation Instructions
             </h2>
 
+            <!-- DC-147: fingerprint verification element. Served as a static
+                 placeholder {{CERT_FINGERPRINT}}; the script below populates
+                 the live value from /api/ca/info (which reads cert-info.json)
+                 when the page is served from ca.<tld>. -->
+            <div class="cert-field" style="grid-column: 1 / -1; margin-top: 1rem;">
+                <div class="cert-label">Verify Before Trusting — Root SHA-256 Fingerprint</div>
+                <div class="cert-value fingerprint cert-value-with-copy" id="fpVerifyBlock">
+                    <code id="fpVerifyValue">{{CERT_FINGERPRINT}}</code>
+                    <button class="copy-btn" onclick="copyFingerprint()" id="fpVerifyCopyBtn">
+                        📋 Copy
+                    </button>
+                </div>
+                <p style="color: var(--muted); font-size: 0.8125rem; margin-top: 0.5rem;">
+                    Compare this fingerprint against the one your device displays during install — they must match exactly. If "{{CERT_FINGERPRINT}}" is still showing, the page hasn't been templated from cert-info.json; use the fingerprint in the Certificate Information card above instead.
+                </p>
+            </div>
+
             <div class="tabs">
                 <button class="tab-btn active" onclick="showTab('windows')">Windows</button>
                 <button class="tab-btn" onclick="showTab('macos')">macOS</button>
@@ -796,7 +813,7 @@
                     <div class="step-number">3</div>
                     <div class="step-content">
                         <h4>Verify installation</h4>
-                        <p>Visit any *.sami domain (like https://status.sami) - you should see a secure connection with no warnings.</p>
+                        <p>Visit any service on your private network domain — you should see a secure connection with no warnings.</p>
                     </div>
                 </div>
             </div>
@@ -865,7 +882,7 @@
                     <div class="step-number">1</div>
                     <div class="step-content">
                         <h4>Scan QR code or visit this page</h4>
-                        <p>Use your iPhone's camera to scan the QR code above, or visit https://ca.sami directly in Safari</p>
+                        <p>Use your iPhone's camera to scan the QR code above, or visit this page in Safari (the address is shown in the QR section).</p>
                     </div>
                 </div>
                 <div class="instruction-step">
@@ -885,8 +902,15 @@
                 <div class="instruction-step">
                     <div class="step-number">4</div>
                     <div class="step-content">
-                        <h4>Trust the certificate</h4>
-                        <p>Go to Settings → General → About → Certificate Trust Settings. Enable full trust for "Sami Home Network Root CA".</p>
+                        <h4>Enable full trust (required second step)</h4>
+                        <p>Installing the profile is <strong>not enough</strong>. Go to <strong>Settings → General → About → Certificate Trust Settings</strong>, find your CA under "Enable Full Trust For Root Certificates", and toggle it <strong>on</strong>. Safari will not trust the CA until this second step is done.</p>
+                    </div>
+                </div>
+                <div class="instruction-step">
+                    <div class="step-number">5</div>
+                    <div class="step-content">
+                        <h4>Verify the fingerprint first</h4>
+                        <p>Before installing, compare the SHA-256 fingerprint shown in the "Certificate Information" card at the top of this page against what your device shows during profile install — they must match exactly.</p>
                     </div>
                 </div>
             </div>
@@ -910,8 +934,8 @@
                 <div class="instruction-step">
                     <div class="step-number">3</div>
                     <div class="step-content">
-                        <h4>Note about user certificates</h4>
-                        <p>Android installs this as a "user" certificate. Some apps may not trust user certificates for security reasons. For full trust, you would need to install it as a system certificate (requires root access).</p>
+                        <h4>⚠️ Important Android caveat: browsers OK, native apps no</h4>
+                        <p>Android installs this as a <strong>user</strong> certificate. Browsers (Chrome, Firefox) will trust it for HTTPS — but most <strong>native apps ignore user CAs</strong> for security reasons, so they will keep showing certificate errors. There is no fix without installing the CA at the system level, which requires a rooted device. Plan browsers-first on Android.</p>
                     </div>
                 </div>
             </div>
@@ -998,6 +1022,9 @@
             }
 
             document.getElementById('certFingerprint').textContent = info.fingerprint;
+            // DC-147: keep the dedicated verify-before-trusting block live too.
+            const fpVerify = document.getElementById('fpVerifyValue');
+            if (fpVerify && info.fingerprint) fpVerify.textContent = info.fingerprint;
         }
 
         // Copy fingerprint to clipboard