The key to this thread is that “HTTPS on ZimaOS” actually describes more than one trust problem. A certificate used by the ZimaOS dashboard does not automatically become the certificate for every Docker application running on another hostname or port.
Separate Dashboard HTTPS from App HTTPS
The current ZimaOS HTTPS certificate guide explains the same boundary: trusting the local ZimaOS certificate can address the dashboard hostname, but applications such as Obsidian, Jellyfin, or Plex are separate services. The Obsidian on ZimaOS is a useful example because browser-based apps can have their own HTTPS and security requirements.
The ZimaBoard 2 hardware provides the current ZimaBoard 2 hardware context, but the certificate problem itself is a hostname, trust-chain, and reverse-proxy issue rather than a board limitation.
Why Importing a CER File May Not Fix the Browser
A trusted certificate must match the hostname the browser is opening and must chain to a trust anchor accepted by that client. Importing one certificate does not make unrelated application ports inherit it. If the browser opens an IP address while the certificate names another host, trust can still fail.
When a Public Certificate Is Needed
Let's Encrypt's Let's Encrypt challenges explains that public certificate issuance requires proving control of the domain name through an ACME challenge. For services you want to expose through a real hostname, a reverse proxy can terminate TLS and forward traffic to internal app ports.
Cloudflare's Cloudflare Tunnel setup likewise maps a public hostname to a local service through a Tunnel. That can solve a different problem from local certificate trust: it provides a managed path from a domain name to the internal application.
Do Not Publish Admin Ports Just for a Padlock
Do not expose ZimaOS or application admin ports directly to the public Internet simply to remove a browser warning. Decide whether the requirement is local-only trust, remote access, or public HTTPS, then design the certificate and proxy path for that specific boundary.
Bottom Line
The community thread was not proof that the ZimaOS CER was broken. The more likely boundary was that the dashboard certificate and separate application services were being treated as one HTTPS endpoint. Trust the dashboard certificate only for the hostname it covers, and use a properly configured reverse proxy or domain certificate for other apps when needed.
