From f6430d0ceed0c41d405b2a448838ba4564791bbc Mon Sep 17 00:00:00 2001
From: satoshi <satoshi@bitcoin.com>
Date: Sun, 26 Apr 2026 18:03:52 +0300
Subject: [PATCH] Properties: expose full stratum TLS cert PEM for miners with
 custom-CA
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AxeOS / Bitaxe firmware verifies the stratum TLS cert against
Espressif's bundled Mozilla CA store. A self-signed cert never
matches anything in that bundle, so the handshake fails with
mbedtls_ssl_handshake -0x3000 (fatal alert) and the miner shows
"Failed to verify certificate". The firmware does, however, expose
a "Stratum SSL Cert" field where a custom CA / trusted root can be
pasted — that's the supported way to use TLS with a self-signed
pool cert.

Read tls/stratum.crt from the main volume and surface the full PEM
(BEGIN/END markers included) as a copyable property. Update the
TLS port and fingerprint descriptions to point users at the new
field with a clear "paste this into your miner's TLS settings"
explanation, instead of the previous wording that implied
disabling cert verification was the only path.
---
 scripts/procedures/properties.ts | 31 +++++++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/scripts/procedures/properties.ts b/scripts/procedures/properties.ts
index 40e0560..42dd26b 100644
--- a/scripts/procedures/properties.ts
+++ b/scripts/procedures/properties.ts
@@ -3,8 +3,11 @@ import { types as T, YAML } from "../deps.ts";
 // StartOS does not forward raw TCP on the LAN interface, so stratum is
 // reached via a router forward or a simpleproxy on another host. We
 // can't know that external IP from inside the container, but we can
-// publish the ports, the variant, and the TLS cert fingerprint so the
-// user has everything they need to configure their miner.
+// publish the ports, the variant, and the TLS cert fingerprint + full
+// PEM so the user has everything they need to configure their miner —
+// including miners (e.g. AxeOS / Bitaxe) whose firmware verifies
+// against a CA bundle and only accepts custom roots when the user
+// pastes the cert in directly.
 export const properties: T.ExpectedExports.properties = async (effects) => {
   const cfg = (await effects
     .readFile({ volumeId: "main", path: "start9/config.yaml" })
@@ -18,6 +21,7 @@ export const properties: T.ExpectedExports.properties = async (effects) => {
   const network = variant === "bitcoind-testnet" ? "testnet4" : "mainnet";
 
   let fingerprint = "";
+  let certPem = "";
   if (tlsEnabled) {
     try {
       fingerprint = (
@@ -29,6 +33,16 @@ export const properties: T.ExpectedExports.properties = async (effects) => {
     } catch {
       fingerprint = "(not yet generated — start the service once)";
     }
+    try {
+      certPem = (
+        await effects.readFile({
+          volumeId: "main",
+          path: "tls/stratum.crt",
+        })
+      ).trim();
+    } catch {
+      certPem = "(not yet generated — start the service once)";
+    }
   }
 
   const data: Record<string, T.PackagePropertyObject["value"] | any> = {
@@ -56,7 +70,7 @@ export const properties: T.ExpectedExports.properties = async (effects) => {
       type: "string",
       value: String(tlsPort),
       description:
-        "TCP port stunnel listens on for TLS stratum. Miners must disable cert verification (self-signed cert) and connect with stratum+ssl://<host>:<port>.",
+        "TCP port stunnel listens on for TLS stratum. Connect miners with stratum+ssl://<host>:<port>. The cert is self-signed — miners that verify against a CA bundle (AxeOS / Bitaxe) need either the full PEM (below) pasted in as a custom root, the SHA-256 fingerprint pinned, or TLS verification disabled, depending on what the firmware exposes.",
       copyable: true,
       qr: false,
       masked: false,
@@ -65,7 +79,16 @@ export const properties: T.ExpectedExports.properties = async (effects) => {
       type: "string",
       value: fingerprint,
       description:
-        "Pin this fingerprint on your miner if its firmware supports it. The certificate is self-signed and regenerated only if you delete tls/stratum.* in the data volume.",
+        "SHA-256 fingerprint of the stratum TLS cert. Use this for fingerprint pinning on miner firmwares that support it. Changes only when the cert is regenerated (delete tls/stratum.* in the data volume to force a new one).",
+      copyable: true,
+      qr: false,
+      masked: false,
+    };
+    data["TLS Certificate (PEM)"] = {
+      type: "string",
+      value: certPem,
+      description:
+        "Full self-signed stratum certificate in PEM format. Paste this into your miner's TLS settings as a custom CA / trusted root (AxeOS exposes a 'Stratum SSL Cert' field for exactly this). Includes -----BEGIN/END CERTIFICATE----- markers; copy the whole block.",
       copyable: true,
       qr: false,
       masked: false,