[BUG] Local TLS certificate is generated as CA:TRUE and rejected by Firefox

Checklist

• My issue is not related to an app I installed through tipi
• My issue is not a support request
• I have searched for an already existing issue with similar context and errors
• I have included a clear description and steps to reproduce
• I have included the result of the command ./runtipi-cli debug
• I have included logs from the file runtipi/logs/error.log if relevant
• I am using a custom docker compose file (user-config/tipi-compose.yml)

Describe the bug

RunTipi's generated local TLS certificate is marked CA:TRUE and is served directly by Traefik as the HTTPS server certificate.

Firefox rejects it with:

MOZILLA_PKIX_ERROR_CA_CERT_USED_AS_END_ENTITY

Other clients may accept the certificate when it is installed as trusted, which makes the issue appear browser-specific.

This affects the local-only domain use case using RunTipi's generated certificate, e.g. app.home.arpa, without Let's Encrypt.

To Reproduce

1. Configure a local domain and local DNS.
2. Expose an app on the local network.
3. Trust the generated RunTipi certificate.
4. Open the local HTTPS URL in Firefox.
5. See MOZILLA_PKIX_ERROR_CA_CERT_USED_AS_END_ENTITY.

Expected behavior

RunTipi should generate a persistent local CA and a separate server certificate:

RunTipi Local CA (CA:TRUE)
    ↓
LOCAL_DOMAIN / *.LOCAL_DOMAIN
CA:FALSE
EKU: serverAuth

Traefik should serve the leaf certificate.

The local CA should persist across restarts and updates so renewed leaf certificates remain trusted without reinstalling the CA.

Public ACME/Let's Encrypt behavior should remain unchanged.

Screenshots

N/A

Server

• OS: Linux 13
• Architecture: arm64
• Tipi Version: v4.10.1

Additional context

No custom RunTipi Docker config is used.

./runtipi-cli debug output can be attached with environment-specific values redacted.

No relevant TLS/certificate entries were found in runtipi/logs/error.log.