# Why Kochab keeps asking to trust a certificate

When a repeated self-signed certificate prompt is a normal side effect of renewal, and when it is a sign to stop and check the server before tapping trust.

Canonical: https://kochab.io/docs/troubleshooting/certificate-keeps-asking-to-trust/

[Certificate trust](/docs/cert-trust/) covers what the first prompt means: Kochab remembers the
exact fingerprint of the certificate you approved, and treats any change as a security event
worth asking about again before it sends credentials to that host. This guide is about what to
do when that prompt comes back.

## Reasons this is normal

A certificate has an expiry date, and something on your end causes a new one to be issued well
before you'd notice the old one lapsing:

- **A reverse proxy on a short renewal cycle.** Let's Encrypt certificates are typically valid
  for 90 days and most proxies renew automatically well before that - Traefik, Caddy, and Nginx
  Proxy Manager all do this without asking.
- **The service itself regenerated a self-signed certificate**, usually after a container
  update, a restart with a fresh data volume, or a reinstall.
- **You changed how you reach it** - moved from a raw LAN address to a reverse-proxy hostname, or
  swapped which proxy sits in front of it.

In all three, you did something (or your infrastructure did, on a schedule) that explains the new
fingerprint. Trusting it again is the same first-time decision you already made.

## Reasons to stop and check first

- **The prompt appears without you having touched the server, the proxy, or the network setup.**
- **You are on a network you do not control** - public Wi-Fi, a hotel, anywhere you would not
  otherwise route homelab traffic through.
- **The new certificate's details do not match what you expect** - a different issuer than your
  proxy normally uses, or a hostname that is not the one you configured.

If any of those apply, do not tap trust from the phone. Check the server directly instead - look
at your reverse proxy's renewal log, or SSH in and check the certificate's issue date. Confirm
the new certificate came from where you think it did before you approve it in Kochab.

## The trust itself is per address, not per service

Kochab pins a certificate to the exact **host and port** it was presented on, not to the service
you named when you added it. Two services on different hosts or different ports - the
[subdomain-per-service shape](/docs/remote-access/) is the common case - get independent trust
decisions, so a renewal on Sonarr's proxy will not touch what Kochab already trusts for Radarr.
If instead you run the [one-hostname-with-a-path shape](/docs/remote-access/), every service
behind that hostname shares the same TLS certificate already, at the network level - approving it
once covers all of them, because there was only ever one certificate to approve.