A camera or printer is still refused after I allowed older TLS. What now?

If a device was refused, you allowed older TLS for its site, and it is **still** refused, the TLS version is no longer the problem. The signature on Passbeam's own certificate is.

Passbeam signs every certificate with an elliptic-curve signature, which is the modern default and what almost everything expects. Some older hardware cannot do elliptic curve at all — it offers only RSA cipher suites — and a device like that cannot verify an elliptic-curve signature either. What you see is a device that takes the whole certificate exchange, gets to the end, and abandons it without saying why. The authentication log names this now: it says the device asked to restart instead of continuing, which usually means it could not use the certificate Passbeam sent it.

The fix is an **appliance certificate authority** — a second, all-RSA authority for that client, which exists to sign one thing: the server certificate those devices are shown. On the client's **Certificates** tab, open **Appliances** and press **Add an appliance**. On that page there is a section headed *“This device still won't authenticate”*; open it, choose **Create an appliance authority for this client**, then **Download the appliance root CA** and install that root on the device in place of the ordinary one.

**Install that root only on the devices that need it, and this is the part that catches people.** Nothing in TLS lets a device say which authority it trusts — Passbeam chooses which certificate to present from the cipher suites the device offers, and nothing else. So a device that *can* do elliptic curve will be shown the ordinary certificate whatever root you gave it, and if that is the only root it holds, it will be refused. This is not a compatibility setting to roll out across a site. Install it on the device that showed the symptom above, and leave everything else on the ordinary root.

Two things that do not change, because both are the opposite of what people expect. The device's own certificate is untouched and needs no reissuing — only the chain Passbeam presents is different, and appliances you have already added keep the certificates they have. And most appliances never need any of this: an older printer at one desk may need it while an equally old one at the next desk does not, because what matters is whether that particular supplicant can do elliptic curve, not how old the hardware looks.