u

jtlsrv-cpp/README.md

@@ -79,17 +79,25 @@ The server starts without MSSQL if `MSSQL_USER` is unset or the connection fails
 
 ## TLS certificates
 
-Place a certificate and key at `certs/cert.pem` and `certs/key.pem` (relative to the working directory when you run the binary).
+From the repo root (preferred — picks up LAN IPs automatically):
+
+```bash
+npm run cert
+# optional extras:
+npm run cert -- 192.168.188.22 sync.quixpos.com
+```
+
+Or manually:
 
 ```bash
 mkdir -p certs
-openssl req -x509 -newkey rsa:2048 -nodes \
+openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \
   -keyout certs/key.pem -out certs/cert.pem -days 3650 \
   -subj '/CN=localhost/O=JTL POS Sync/C=DE' \
-  -addext 'subjectAltName=DNS:localhost,IP:127.0.0.1,IP:0.0.0.0'
+  -addext 'subjectAltName=DNS:localhost,DNS:sync.quixpos.com,IP:127.0.0.1,IP:0.0.0.0,IP:192.168.188.22'
 ```
 
-On startup the server prints the pairing code and whether MSSQL connected.
+Place `certs/cert.pem` and `certs/key.pem` relative to the working directory when you run the binary. The browser hostname check requires the address you open (`192.168.x.x` or a DNS name) to appear in the certificate SAN — trusting a CA alone is not enough.
 
 ## API endpoints