AxeOS / Bitaxe firmware verifies the stratum TLS cert against
Espressif's bundled Mozilla CA store. A self-signed cert never
matches anything in that bundle, so the handshake fails with
mbedtls_ssl_handshake -0x3000 (fatal alert) and the miner shows
"Failed to verify certificate". The firmware does, however, expose
a "Stratum SSL Cert" field where a custom CA / trusted root can be
pasted — that's the supported way to use TLS with a self-signed
pool cert.
Read tls/stratum.crt from the main volume and surface the full PEM
(BEGIN/END markers included) as a copyable property. Update the
TLS port and fingerprint descriptions to point users at the new
field with a clear "paste this into your miner's TLS settings"
explanation, instead of the previous wording that implied
disabling cert verification was the only path.
satoshi
f6430d0cee