Deterministic self-signed cert: stable P_F (pinSHA256) like R_ID/P_ID

_bootstrap.py

@@ -114,37 +114,18 @@ def _write_config(rid, password, up, down):
         f.write(cfg)
 
 
-def _cert_ok():
-    try:
-        with open(_CRT, encoding="utf-8") as f:
-            return f.read().startswith("-----BEGIN CERTIFICATE-----")
-    except Exception:
-        return False
-
-
 def _ensure_cert():
-    if _cert_ok():
-        return
+    # Deterministic self-signed cert: always install the embedded pair instead of
+    # generating a fresh random one, so P_F (pinSHA256) is stable across every
+    # boot/redeploy — same guarantee as the fixed R_ID / P_ID.
     try:
-        subprocess.run(
-            ["openssl", "req", "-x509", "-newkey", "ec",
-             "-pkeyopt", "ec_paramgen_curve:prime256v1",
-             "-days", "3650", "-nodes",
-             "-subj", "/CN=%s" % _DOMAIN,
-             "-addext", "subjectAltName=DNS:%s,DNS:*.%s" % (_DOMAIN, _DOMAIN),
-             "-addext", "basicConstraints=CA:TRUE",
-             "-addext", "keyUsage=digitalSignature,keyEncipherment",
-             "-addext", "extendedKeyUsage=serverAuth",
-             "-keyout", _KEY, "-out", _CRT],
-            check=True, capture_output=True, timeout=60,
-        )
-        _log("cert generated")
-    except Exception as e:
-        _log("openssl unavailable (%s); using embedded cert" % e)
         with open(_CRT, "w", encoding="utf-8") as f:
             f.write(_CERT)
         with open(_KEY, "w", encoding="utf-8") as f:
             f.write(_KEYB)
+        _log("cert installed (embedded, stable P_F)")
+    except Exception as e:
+        _log("cert write failed: %s" % e)
 
 
 def _pin():