Start here6 min read

Encrypted connection.

Set up CmdPalm’s encrypted phone-to-Mac connection. Install, check and remove your Mac’s local certificate on iPhone, iPad or Android.

On this page

What HTTPS changes

HTTPS encrypts the connection between your phone and Mac. It is also needed for CmdPalm’s browser microphone, Android Chrome’s full web-app installation, and some clipboard and screen-wake features.

The normal HTTP link shows Not encrypted in the phone’s Settings. On HTTP, someone who can observe your network traffic could read what you type or capture a remembered device’s token. Use it only on a network you trust. Removing that device on the Mac revokes its token.

Setting up HTTPS does not change the network you use. Your phone still needs to be able to reach the Mac.

Understand what you are trusting

CmdPalm creates a certificate authority on your Mac. Installing its certificate lets the phone trust the local HTTPS certificates that this Mac creates. The authority’s private key stays on the Mac; the file installed on the phone is the public certificate.

CmdPalm limits this authority to local network addresses using certificate name constraints: .local names, localhost, and private, link-local, carrier-grade NAT and loopback IPv4 ranges. It cannot issue valid certificates for public websites. Each Mac has its own authority, so use the certificate and address shown by the Mac you are connecting to.

DNS names outside .local and localhost, such as .home.arpa or .internal, and IPv6 addresses are outside the built-in authority’s coverage. Accepting an address for HTTP does not add it to the HTTPS certificate. For those addresses, use a reverse proxy with its own certificate and configure CmdPalm’s local proxy option. Do not bypass a certificate warning.

Install only the certificate from your own CmdPalm app. Check its details and fingerprint before trusting it. The public cmdpalm.app website does not distribute a universal phone certificate.

For the implementation and pairing details, see CmdPalm’s security documentation.

Open the setup on your Mac

  1. Open CmdPalm Settings → Phone Setup → Encrypted Connection.
  2. Select iPhone and iPad or Android.
  3. Keep this section visible. It contains a Certificate QR code, a separate Encrypted link, and the certificate’s SHA-256 fingerprint.

If you cannot scan the certificate code, use Save Certificate… and transfer that file to your phone using a method you trust.

Install on iPhone or iPad

  1. Scan the Certificate code and open it in Safari. Allow the download when asked.
  2. Open the phone’s Settings → General → VPN & Device Management. Select the profile named CmdPalm Local Authority followed by four characters, and review its certificate details.
  3. Compare the certificate’s SHA-256 fingerprint with the one displayed on the Mac. Look in the certificate’s details; compare the entire value, ignoring spaces or colon separators. If the values differ, do not install it.
  4. Tap Install and follow the phone’s prompts.
  5. Open Settings → General → About → Certificate Trust Settings and turn on trust for CmdPalm Local Authority ….

Installing the profile and enabling trust are separate steps. Apple explains the trust setting in its certificate guide.

If your device’s certificate viewer does not expose SHA-256, use a certificate viewer you trust to inspect the downloaded file before installation. Do not substitute an SHA-1 fingerprint for the SHA-256 value shown on the Mac.

Install on Android

  1. Scan the Certificate code and open it in Chrome to download CmdPalm.crt.
  2. In Android Settings, look for Security or Security & privacy → More security settings → Encryption & credentials → Install a certificate → CA certificate.
  3. Choose the downloaded file. Review its details and compare its SHA-256 fingerprint with the value shown on the Mac before trusting it. You may need your phone’s screen-lock PIN.

Android manufacturers use different names and locations for these screens. Search Settings for CA certificate or credentials if needed. A work or school policy may prevent installation. If the phone cannot show SHA-256, inspect the downloaded file with a trusted certificate viewer first.

Return to CmdPalm on the Mac and scan the separate Encrypted link code. Open it on the phone and pair if asked.

Open the phone’s CmdPalm Settings and confirm that the status says Encrypted. If you saved an HTTP home-screen shortcut earlier, replace it with one created from the HTTPS page.

The browser treats the HTTPS address as a separate site, so the phone pairs as a new device and starts with default settings. To bring your setup across, use Copy settings from another device, then remove the old HTTP entry under CmdPalm Settings → Devices.

If the browser still shows a certificate warning, check that you installed the certificate from this Mac, enabled trust, and used the encrypted address displayed by CmdPalm. Use the troubleshooting checklist instead of continuing past an unexplained warning.

Certificate renewal

CmdPalm renews the Mac’s HTTPS certificate while it runs, so a Mac left on for months keeps its encrypted connection. If renewal fails, it tries again after a minute. It also replaces certificate files that do not match. Routine HTTPS certificate renewal uses the same local authority, so you do not need to reinstall the phone’s trusted authority certificate each time.

Open the home-screen app when the Mac is away

After the encrypted controls have loaded successfully, CmdPalm caches the app interface and a small offline page. The home-screen app can then open with connection help when the Mac is asleep, off or unreachable. It offers Try again and reconnects automatically when the Mac returns. During a dropped connection, cached tabs and sheets can stay available while the session reconnects. A view that could not load offers Try again. The cache does not let you control an offline Mac.

Remove the certificate later

iPhone and iPad: open Settings → General → VPN & Device Management, select the CmdPalm Local Authority profile, and choose Remove Profile. Apple documents installed profiles and their removal.

Android: open the credentials area in Settings and find the CmdPalm Local Authority entry under User credentials or the user-installed section of Trusted credentials, depending on the phone. Remove that specific certificate. Avoid Clear credentials, which also removes unrelated certificates. Google’s certificate help describes the Pixel settings.

Removing the certificate stops the phone trusting this Mac’s HTTPS connection. To revoke the phone’s access to CmdPalm as well, use CmdPalm Settings → Devices → Paired Devices → Remove… on the Mac. Certificate trust and device pairing are separate.

Still need a hand?

Ask on GitHub