Why Kochab keeps asking to trust a certificate

When a repeated self-signed certificate prompt is a normal side effect of renewal, and when it is a sign to stop and check the server before tapping trust.

Certificate trust covers what the first prompt means: Kochab remembers the exact fingerprint of the certificate you approved, and treats any change as a security event worth asking about again before it sends credentials to that host. This guide is about what to do when that prompt comes back.

Reasons this is normal

A certificate has an expiry date, and something on your end causes a new one to be issued well before you’d notice the old one lapsing:

• A reverse proxy on a short renewal cycle. Let’s Encrypt certificates are typically valid for 90 days and most proxies renew automatically well before that - Traefik, Caddy, and Nginx Proxy Manager all do this without asking.
• The service itself regenerated a self-signed certificate, usually after a container update, a restart with a fresh data volume, or a reinstall.
• You changed how you reach it - moved from a raw LAN address to a reverse-proxy hostname, or swapped which proxy sits in front of it.

In all three, you did something (or your infrastructure did, on a schedule) that explains the new fingerprint. Trusting it again is the same first-time decision you already made.

Reasons to stop and check first

• The prompt appears without you having touched the server, the proxy, or the network setup.
• You are on a network you do not control - public Wi-Fi, a hotel, anywhere you would not otherwise route homelab traffic through.
• The new certificate’s details do not match what you expect - a different issuer than your proxy normally uses, or a hostname that is not the one you configured.

If any of those apply, do not tap trust from the phone. Check the server directly instead - look at your reverse proxy’s renewal log, or SSH in and check the certificate’s issue date. Confirm the new certificate came from where you think it did before you approve it in Kochab.

The trust itself is per address, not per service

Kochab pins a certificate to the exact host and port it was presented on, not to the service you named when you added it. Two services on different hosts or different ports - the subdomain-per-service shape is the common case - get independent trust decisions, so a renewal on Sonarr’s proxy will not touch what Kochab already trusts for Radarr. If instead you run the one-hostname-with-a-path shape, every service behind that hostname shares the same TLS certificate already, at the network level - approving it once covers all of them, because there was only ever one certificate to approve.