Certificate trust

How Kochab handles self-signed TLS certificates without sending keys to an unknown host.

Self-signed certificates are common in homelabs. Kochab uses explicit fingerprint trust so a known certificate can work without disabling TLS safety for every host.

If a certificate changes later, Kochab treats that as a security event and asks you to verify the new fingerprint before sending credentials.

If that prompt keeps coming back, see Why does Kochab keep asking me to trust a new certificate? for when that is expected and when to stop and check the server first.

Trust on first connect, or import a CA

Kochab can trust a server’s own certificate in two ways. Pick the one that matches how the certificate was made.

Trust on first connect

Use this for a self-signed certificate, and for the factory default certificate a NAS ships with (TrueNAS and Synology both create one at setup). The first time Kochab connects, it shows the certificate’s subject, issuer, dates, and SHA-256 fingerprint. Tap Trust and Kochab pins that exact certificate for that address.

The pin covers one certificate. If the server presents a different one, Kochab stops and asks you again before it sends any credentials. Renewing or regenerating the certificate causes the same prompt. That is expected, and the troubleshooting guide covers how to tell a renewal from a problem.

Import a CA

Use this only if you run your own certificate authority and issue your servers’ certificates from it. Go to Settings > Security & Trust > Import CA certificate and choose the host. Kochab then trusts any certificate that CA signs for that host, so a renewal does not prompt you again.

The server’s certificate must list the hostname or IP you use in Kochab in its subject alternative names (SAN). If it does not, the connection fails even when the CA is correct. Kochab checks the name the same way a browser does. On iPhone and iPad, the server’s certificate must also be valid for 398 days or less and allow server authentication (the serverAuth extended key usage).

Factory default certificates: trust on first connect

TrueNAS and Synology ship with default certificates made for a placeholder name: localhost on TrueNAS, synology on Synology. Neither name is the address you connect with, so importing either default certificate as a CA does not work, and neither does importing the Synology Inc. CA. Trust the default certificate on first connect instead.

If you have already imported one:

  1. Go to Settings > Security & Trust and tap Remove CA for that host.
  2. Open the service, tap the edit (pencil) button, then Save changes.
  3. When Kochab shows the certificate, tap Trust.

On iPhone and iPad you can skip the first step: when you save the service, Kochab offers Trust server certificate instead, which removes the CA and pins the certificate in one go. Choose it from Save changes, not Re-test, so the change is kept.