diff --git a/docker_entrypoint.sh b/docker_entrypoint.sh
index d02681b..7146315 100755
--- a/docker_entrypoint.sh
+++ b/docker_entrypoint.sh
@@ -150,7 +150,11 @@ if [[ "${TLS_ENABLED}" == "enabled" ]]; then
     # or doesn't match this version. This is more reliable than poking
     # at the existing cert's extensions — we know *exactly* when a new
     # shape is required and the upgrade self-heals on next boot.
-    TLS_CERT_VERSION=3
+    # v4: broaden subjectAltName to cover mDNS / LAN / Tor hostnames
+    #     so miner firmwares that verify the SAN against the hostname
+    #     they were pointed at (e.g. AxeOS connecting to host.local)
+    #     stop failing with MBEDTLS_ERR_X509_CERT_VERIFY_FAILED.
+    TLS_CERT_VERSION=4
 
     NEEDS_REGEN=false
     if [[ ! -f "${CERT}" || ! -f "${CRT}" || ! -f "${KEY}" ]]; then
@@ -187,10 +191,27 @@ subjectKeyIdentifier = hash
 subjectAltName       = @alt_names
 
 [ alt_names ]
-DNS.1 = kamado-pool.embassy
-DNS.2 = kamado-pool
-DNS.3 = localhost
-IP.1  = 127.0.0.1
+# Specific StartOS / local names the pool might be reached through.
+DNS.1  = kamado-pool.embassy
+DNS.2  = kamado-pool
+DNS.3  = localhost
+# Wildcard SANs covering the TLDs miners typically use:
+#   *.local     -> mDNS / Bonjour (e.g. obese-admirer.local on AxeOS)
+#   *.embassy   -> StartOS inter-service hostnames
+#   *.onion     -> Tor hidden services
+#   *.home.arpa -> RFC 8375 home network namespace
+#   *.lan       -> common consumer router default TLD
+#   *.internal  -> some LAN setups
+# Strictly leftmost-label wildcards per RFC 6125; libraries that
+# enforce this (mbedtls, OpenSSL, BoringSSL, Go crypto/tls) all
+# accept them.
+DNS.4  = *.local
+DNS.5  = *.embassy
+DNS.6  = *.onion
+DNS.7  = *.home.arpa
+DNS.8  = *.lan
+DNS.9  = *.internal
+IP.1   = 127.0.0.1
 OPENSSL_CONF
 
         openssl req -x509 -newkey rsa:2048 -nodes \