This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
Overpass serves private fallback certificates, so op, nodes and browsers
do not trust them unless they use a pin, install the local CA, or opt into
--insecure for development. For a publicly trusted certificate, terminate TLS
on a reverse proxy in front of the web port.
Fallback TLS uses two leaves, not mutual TLS. The proxy chooses by connection audience, not merely by the algorithms a TLS client supports:
- ECDSA P-256, issued by the local
tls-ca.crt, for every web request and for agents that cannot do ML-DSA. - ML-DSA-44 (the default) only for Go 1.27 agents that advertise an Overpass ALPN and support the algorithm.
Each online server’s Details card shows which algorithm that agent’s tunnel actually used. Switching the cluster setting reconnects agents onto the new leaf. Agent identity is still the SSH host certificate, not an X.509 client certificate.
The agent algorithm is configured in the web UI under Settings → Certificates
(or via the settings API, or settings.agent_tls in the config file).