Oh Dear's status pages now support custom TLS certificates. Users can upload their own certificate and private key (from a private PKI, internal CA, or Cloudflare Origin CA) or download an origin certificate generated by Oh Dear. This resolves Cloudflare's Error 526 that occurred when using Full (strict) SSL mode, which previously failed because status page origins served self-signed certificates. The implementation uses Caddy's get_certificate HTTP lookup for per-handshake certificate resolution, with an open-sourced caching wrapper (caddy-get-certificate-cache) to avoid hammering the backend on every TLS handshake. Security measures include domain verification before certificate activation, encrypted-at-rest private keys that are never exposed, and upload-time validation rejecting mismatched keys, wrong-domain certs, or expired certificates.
