> ## Documentation Index
> Fetch the complete documentation index at: https://gerfaut-wallet.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Certificates

> Trust the self-signed certificate of your own Electrum server by its fingerprint, and decide what to do when a server's certificate changes.

Accept the certificate of your own Electrum server once, by its fingerprint. Gerfaut then refuses any other certificate from that host until you decide.

## Accept your server's certificate

Gerfaut opens `This server signs its own certificate` when you select **Save backend** and the server answers. Until you accept the certificate, syncs with that server fail. A `.onion` server skips this step.

> [!NOTE]
>
> When the server does not answer, Gerfaut saves the backend with `Saved. The server did not answer, so its certificate is unchecked.` Gerfaut never asks about that certificate later. If the server signs its own, select **Save backend** again once it answers.

**1. Print the fingerprint on your server**

On the machine that runs the server, run the command the dialog shows, with the path of the certificate file:

```bash theme={null}
openssl x509 -noout -fingerprint -sha256 -in cert.pem
```

**2. Compare it with the one Gerfaut shows**

The two SHA-256 fingerprints must match, character for character.

**3. Select Accept and save**

Gerfaut records the fingerprint for that host and saves the backend.

**Android**

<video autoPlay muted loop playsInline preload="metadata" src="https://mintcdn.com/gerfaut/lxGkHstk_-7EsZEA/videos/settings/accept-a-certificate-android.mp4?fit=max&auto=format&n=lxGkHstk_-7EsZEA&q=85&s=3f600f10ffcb7a857d33733f98c7eac6" aria-label="Accepting a certificate on Android: My own Electrum server with its host and port, Save backend, the dialog This server signs its own certificate with the SHA-256 fingerprint, then Accept and save." />

**Desktop**

<video autoPlay muted loop playsInline preload="metadata" src="https://mintcdn.com/gerfaut/lxGkHstk_-7EsZEA/videos/settings/accept-a-certificate-desktop.mp4?fit=max&auto=format&n=lxGkHstk_-7EsZEA&q=85&s=af1cc55de7fac9551361dbaaccca0eca" aria-label="Accepting a certificate on desktop: My own Electrum server with its host and port, Save backend, the dialog This server signs its own certificate with the SHA-256 fingerprint, then Accept and save." />

## Decide when a certificate changes

When the host presents another certificate, syncs fail with `the server's certificate changed`. Select **Save backend** in **Settings** > **Network** to open `This server's certificate changed`, with the fingerprints `Accepted before` and `Presented now`.

> [!WARNING]
>
> Either whoever runs the server replaced the certificate, or something answers in its place and reads the addresses you watch. Ask whoever runs the server before you accept.

**1. Check the new fingerprint with whoever runs the server**

Select **Cancel** if you cannot. Gerfaut then saves nothing and trusts nothing.

**2. Select Trust the new certificate**

Then confirm.

**Android**

Select **Trust it anyway**.

**Desktop**

Select **Yes, trust the new certificate**.

## Forget a certificate

> [!NOTE]
>
> Once you forget a certificate, syncs with its server fail until you select **Save backend** again and accept the certificate.

**1. Select Forget on the line of the server**

In **Settings** > **Network**, the `Trusted certificates` card lists each server whose certificate you accepted.

**2. Confirm**

**Android**

Select **Forget certificate** under the line.

**Desktop**

Select **Forget it** in `Forget this certificate?`.

Gerfaut shows `Certificate forgotten` and removes the line.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.