# Installing the Hub Certificate
> Source: https://www.fuze-store.com/docs/hub/installing-the-hub-certificate

# Installing the Hub Certificate

Your browser shows **Not Secure** on your Hub's `https://localhost:18443` address.
That's expected — the Hub issues its own certificate, because no public certificate
authority will issue one for an address on your own computer.

Installing this shop's Hub certificate replaces that warning with a normal lock.

  Chrome, Safari, Edge, Brave, Arc, and Opera all read the certificate list your
  operating system keeps, so installing it once covers all of them on this
  computer.

  **Firefox is the exception on every platform** — it keeps its own list and
  ignores the operating system's, so it needs the separate step in the Firefox
  section below.

  Everything works without it — pairing, printing, kitchen displays, and the
  customer screen are all unaffected. Install it only if you want the lock icon
  instead of the warning. You can undo it at any time.

## Before you start

  Hub certificates issued before this guide's security update need replacing. Delete
  the old entry using the "Removing it" steps for your operating system, then download
  a fresh copy and install that. Your tills and printers are unaffected and nothing
  needs re-pairing — only the browser lock stops working until you do.

  If your Hub ever regenerates its certificate, every copy you downloaded before
  that stops working. It will still install without complaining — it just won't
  produce the lock. If the warning comes back, download a fresh copy, remove the
  old entry, and install the new one.

## macOS

Double-click the downloaded `.crt` file. A window titled **Add Certificates** appears.

There's a **Keychain** dropdown at the bottom. macOS preselects **iCloud** — change it to **login**, then click **Add**.

This step matters. **iCloud** copies the certificate to your iPhone, iPad, and every other Mac signed in to your Apple Account, none of which need it. **System** applies it to every user account on this computer. **login** is the correct choice: just you, just this computer.

Keychain Access opens with the certificate added. Search for **Fuze Store Hub** — the entry is named after your Hub, for example `Fuze Store Hub - Counter Hub`. It will say *"This root certificate is not trusted"*, which is normal at this point.

Double-click the entry, then click the arrow next to **Trust** to expand that section.

Leave **When using this certificate** on *Use System Defaults*, and change only
**Secure Sockets Layer (SSL)** to **Always Trust**. Leave every other row on
*no value specified*.

The top dropdown would trust the certificate for everything at once — email, signed software, and more. Setting only **SSL** gets you the lock while keeping it from vouching for anything else.

Close the certificate window. macOS asks for your Mac password — enter it.

Nothing is saved until you close the window. Once it's done, the entry reads
*"This certificate is marked as trusted for this account."*

Quit your browser completely (**Cmd-Q**, not just closing the tab) and reopen it. Browsers only check for newly trusted certificates when they start.

Go to `https://localhost:18443/health` — you should see a lock and a short line of text starting with `{"ok":true`.

### Removing it on macOS

Open Keychain Access, find the **Fuze Store Hub** entry, right-click, and choose
**Delete**. The warning comes back, and nothing else changes.

## Windows

Double-click the downloaded `.crt` file, then click **Install Certificate**.

Select **Current User** and click **Next**.

**Local Machine** applies the certificate to everyone who uses this computer and needs an administrator. **Current User** is enough for the lock.

Select **Place all certificates in the following store**, click **Browse**, choose **Trusted Root Certification Authorities**, then **Next** and **Finish**.

Do not leave the default **Automatically select the certificate store**. That files it under Personal, where Windows ignores it — the certificate installs successfully and the warning stays exactly as it was.

Windows shows a warning saying it cannot verify the certificate's origin, and asks whether you want to install it. This is the expected prompt for any certificate that isn't from a public authority. Click **Yes**.

Close Chrome or Edge completely and reopen it, then go to `https://localhost:18443/health`. You should see a lock.

### Removing it on Windows

Press **Win-R**, type `certmgr.msc`, and press Enter. Open **Trusted Root
Certification Authorities → Certificates**, find the **Fuze Store Hub** entry,
right-click, and choose **Delete**.

## Linux

Linux has no single certificate store, so the steps depend on your browser.

**Chrome and Edge** keep their own store. In a terminal, from the folder holding the
downloaded file:

```
certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n "Fuze Store Hub" -i fuze-store-hub.crt
```

If `certutil` isn't installed, add it with `sudo apt install libnss3-tools` on
Debian or Ubuntu, or `sudo dnf install nss-tools` on Fedora.

Restart the browser afterwards.

To remove it:

```
certutil -d sql:$HOME/.pki/nssdb -D -n "Fuze Store Hub"
```

## Firefox (any platform)

Firefox ignores the operating system's certificate store, so the steps above do not
affect it — even on macOS and Windows.

Open **Settings → Privacy & Security**, scroll to **Certificates**, click **View
Certificates**, choose the **Authorities** tab, and click **Import**. Select the
downloaded file, tick **Trust this CA to identify websites**, and click **OK**.

## If you uninstall Fuze Store Hub

**Uninstalling the app does not remove this certificate.** Your computer keeps
trusting it until you remove it yourself, using the steps above for your operating
system.

Uninstalling also leaves the Hub's files on the computer, including the private half
of this certificate. That file is readable only by your own user account, but if you
are decommissioning the computer — selling it, returning it, handing it to someone
else — remove both:

Follow the "Removing it" steps above for macOS, Windows, or Linux. Do this even if
the Hub is already uninstalled — the two are independent.

**On Windows the uninstaller can do this for you.** When you uninstall, tick **Also
delete this computer's local Hub data**. Leave it unticked if you are reinstalling or
upgrading — it also removes your audit log, print queue, and kitchen display data.

Otherwise, delete the Fuze Store Hub data folder by hand:

- **macOS** — `~/Library/Application Support/Fuze Store Hub`
- **Windows** — `%APPDATA%\Fuze Store Hub`
- **Linux** — `~/.config/Fuze Store Hub`

If the Hub is still installed, the tidier route is **Settings → Danger zone → Reset
Fuze Store Hub** with **Also delete this store's local data** ticked, which removes
the certificate files for you. It still cannot remove the certificate from your
operating system — that is step 1, and only you can do it.

  Adding a certificate to your operating system's trusted list is something you
  approve yourself — which is why it asked for your password. Removing it works the
  same way round: no app can quietly add or remove entries on your behalf.

## It's installed but the warning is still there

## What you are trusting

This certificate is created on your Hub computer and belongs only to your shop. The
private half never leaves that computer — it is not in the download, not in support
bundles, and never sent over the internet.

Installing it tells your browser to trust certificates signed by your Hub — and the
certificate is built so that is **all** it can do. It is locked to the address
`localhost` on this computer, so it cannot vouch for any named website: not
`google.com`, not your bank, not your email. Even someone who copied it off the
computer could not use it to impersonate those sites. Your browser enforces that
limit.

Remove it at any time using the steps above, and your computer returns to exactly how
it was.

Every download is recorded in the [Audit Log](/docs/hub/audit-log).