diff --git a/scripts/procedures/properties.ts b/scripts/procedures/properties.ts
index 40e0560..42dd26b 100644
--- a/scripts/procedures/properties.ts
+++ b/scripts/procedures/properties.ts
@@ -3,8 +3,11 @@ import { types as T, YAML } from "../deps.ts";
 // StartOS does not forward raw TCP on the LAN interface, so stratum is
 // reached via a router forward or a simpleproxy on another host. We
 // can't know that external IP from inside the container, but we can
-// publish the ports, the variant, and the TLS cert fingerprint so the
-// user has everything they need to configure their miner.
+// publish the ports, the variant, and the TLS cert fingerprint + full
+// PEM so the user has everything they need to configure their miner —
+// including miners (e.g. AxeOS / Bitaxe) whose firmware verifies
+// against a CA bundle and only accepts custom roots when the user
+// pastes the cert in directly.
 export const properties: T.ExpectedExports.properties = async (effects) => {
   const cfg = (await effects
     .readFile({ volumeId: "main", path: "start9/config.yaml" })
@@ -18,6 +21,7 @@ export const properties: T.ExpectedExports.properties = async (effects) => {
   const network = variant === "bitcoind-testnet" ? "testnet4" : "mainnet";
 
   let fingerprint = "";
+  let certPem = "";
   if (tlsEnabled) {
     try {
       fingerprint = (
@@ -29,6 +33,16 @@ export const properties: T.ExpectedExports.properties = async (effects) => {
     } catch {
       fingerprint = "(not yet generated — start the service once)";
     }
+    try {
+      certPem = (
+        await effects.readFile({
+          volumeId: "main",
+          path: "tls/stratum.crt",
+        })
+      ).trim();
+    } catch {
+      certPem = "(not yet generated — start the service once)";
+    }
   }
 
   const data: Record<string, T.PackagePropertyObject["value"] | any> = {
@@ -56,7 +70,7 @@ export const properties: T.ExpectedExports.properties = async (effects) => {
       type: "string",
       value: String(tlsPort),
       description:
-        "TCP port stunnel listens on for TLS stratum. Miners must disable cert verification (self-signed cert) and connect with stratum+ssl://<host>:<port>.",
+        "TCP port stunnel listens on for TLS stratum. Connect miners with stratum+ssl://<host>:<port>. The cert is self-signed — miners that verify against a CA bundle (AxeOS / Bitaxe) need either the full PEM (below) pasted in as a custom root, the SHA-256 fingerprint pinned, or TLS verification disabled, depending on what the firmware exposes.",
       copyable: true,
       qr: false,
       masked: false,
@@ -65,7 +79,16 @@ export const properties: T.ExpectedExports.properties = async (effects) => {
       type: "string",
       value: fingerprint,
       description:
-        "Pin this fingerprint on your miner if its firmware supports it. The certificate is self-signed and regenerated only if you delete tls/stratum.* in the data volume.",
+        "SHA-256 fingerprint of the stratum TLS cert. Use this for fingerprint pinning on miner firmwares that support it. Changes only when the cert is regenerated (delete tls/stratum.* in the data volume to force a new one).",
+      copyable: true,
+      qr: false,
+      masked: false,
+    };
+    data["TLS Certificate (PEM)"] = {
+      type: "string",
+      value: certPem,
+      description:
+        "Full self-signed stratum certificate in PEM format. Paste this into your miner's TLS settings as a custom CA / trusted root (AxeOS exposes a 'Stratum SSL Cert' field for exactly this). Includes -----BEGIN/END CERTIFICATE----- markers; copy the whole block.",
       copyable: true,
       qr: false,
       masked: false,