Let the SSL check lower the flag, not only raise it

Shipped

August 23, 2026 at 5:31 AM UTC

Author

kamo

Commit

dfdf625

checkDns only ever latched sslConfirmed to true. A domain whose stored flag was set under the old any-one-host rule therefore kept a green SSL card and an unlocked Enter Workspace even when that very response listed hosts with no certificate. verify-dns now probes every host on each call, so take its answer in both directions. Only the state is updated, not the domain object: every consumer of "is SSL ready" reads the state, and rewriting domain here would change its identity on each check while domain is a dependency of the effect that calls it.