Transport

QuantumTouch is served over HTTPS only, bound by default to 0.0.0.0:8443.
There is no plain-HTTP listener and therefore no HTTP-to-HTTPS redirect — a
request to port 80 is refused at the socket, not redirected.

Three certificate sources are supported. The default is a local certificate
authority, self-signed at install with an 825-day validity and subject
alternative names covering the LAN address, loopback, localhost, and the host's
name. A customer-supplied certificate and key may be imported, in which case
automatic renewal is disabled. ACME issuance is supported natively for
deployments with a publicly resolvable name.

For an integrating script the practical guidance is: copy the CA certificate off
the box once and pin it. Disabling verification is not the recommended posture
for a management-plane credential.

Certificate renewal is a hot reload — the worker reloads on certificate change
without a restart, so a long-lived integration does not observe a connection
outage at renewal.

HTTP Strict Transport Security is off by default, because a local-CA trust
relationship is fragile and an HSTS pin against a certificate the operator may
later replace is a support hazard.