From Self-Signed to ZeroSSL: How I Made My Baccarat PRO Tool Work on Mobile (6-Hour Log)

By Chen Zhiyuan | Aug 29, 2026 | Tool Tutorial / 4 min read

Last Wednesday at 3 PM, I opened my baccarat PRO tool on my phone at Starbucks to check a shoe pattern. Safari flashed a full-screen red warning: "This website does not support secure connections." It worked fine on my laptop. As soon as I switched to mobile, it broke.

Switched to WiFi. Same error. Opened Chrome at home to reproduce: self-signed cert on desktop shows a small yellow "Proceed anyway" button. On iOS Safari it shows a giant red warning. Android Chrome 90+ doesn't even give you the option — straight ERR_CERT_AUTHORITY_INVALID.

This article is the full 6-hour log: symptom → diagnosis → fix → pitfalls → before/after. If you self-host any web tool, this matters for you too.

Symptom: 80% of mobile browsers reject self-signed certs

• ✅ Desktop Chrome / Edge / Firefox: "Your connection is not private" → Advanced → Proceed → works
• ❌ iOS Safari (incognito): hard-blocked. Regular mode works with 5s delay + red full-screen warning
• ❌ Android Chrome 90+: no proceed button, straight ERR_CERT_AUTHORITY_INVALID
• ❌ WeChat / QQ / Weibo in-app browser: silently blocked, page hangs then white-screens

I sent my PRO tool link to 12 friends. Desktop: 11/12 worked. Mobile: only 2/12 (old Android + legacy Chrome). That's 80% of potential users locked out.

Our PHD tool had the same issue. After the fix, mobile works directly. Comparison shots below.

Decision: skip commercial cert, use ZeroSSL free

My requirements were simple:

1. Trusted CA (not self-signed)
2. Valid 3+ months (no monthly renewal hassle)
3. Single domain: www.baccpc.com (where my PRO tool lives on port 8000)
4. Free

Survey of options:

Picked ZeroSSL over Let's Encrypt because ZeroSSL uses DNS CNAME validation (no need to expose port 80 or install acme.sh on my server — port 80 is already taken by IIS).

(Postscript: the 90-day renewal is the same flow. I'll write a separate renewal SOP next week.)

4-step install (30 min actual work, 4 hr of pitfalls)

Step 1: Apply via ZeroSSL (10 min)

zerossl.com → New Certificate → www.baccpc.com → 90-day free → it gives a CNAME record. Add to GoDaddy DNS, wait 5-10 min for validation:

Host: _5CA856F20F2D109CF6B26F0927B1A43C.baccpc.com
Value: 9f7b11cfa5af85172870e15936857fb9.4a282cda8c9d892096197e0833bf72a0.ab12883837f650a.comodoca.com

Step 2: Download cert (1 min)

Get certificate.crt + ca_bundle.crt + private.key. Merge leaf + chain into one cert.pem.

Pitfall #1: Don't use PowerShell Get-Content | Set-Content to merge — it adds CRLF line endings, and Python 3.8 OpenSSL rejects with KEY_VALUES_MISMATCH. Use Python cryptography library with strict LF.

Step 3: Flask ssl_context (5 min)

from werkzeug.serving import make_server
import threading

cert = "cert.pem"
key  = "key.pem"

https_srv = make_server('0.0.0.0', 8000, app,
                         ssl_context=(cert, key),
                         threaded=True)
threading.Thread(target=https_srv.serve_forever,
                 daemon=True).start()
https_srv.serve_forever()

Flask 1.0+ has native SSL support, no nginx/gunicorn needed.

Step 4: Verify (10 min)

Open https://www.baccpc.com:8000/ on desktop + mobile. Look for: green padlock + "ZeroSSL RSA DV SSL CA 2" issuer + no warning.

4 Pitfalls that ate 4 hours

1. PowerShell Get-Content merges with CRLF → use Python cryptography with strict LF
2. ZeroSSL free = single domain only (multi-domain silently ignored) → re-apply with just www
3. GoDaddy DNS CNAME with leading/trailing space from copy-paste → nslookup revealed the issue
4. Flask 1.0.1 has no SNI → one cert per process, multiple domains need multiple ports

Each one is worth a separate article. I'll write a "ZeroSSL + Flask pitfall compendium" next time.

Before / After

3 screenshots:

Fig 1: iOS Safari self-signed warning - red full-screen (before)

Fig 2: After ZeroSSL - green padlock + "ZeroSSL RSA DV SSL CA 2" issuer

Fig 3: Same phone, same tool, 5-second access comparison

Sent the link to the same 12 friends after the fix. 12/12 worked. 3 asked "is this a paid tool, why no ads?" I laughed.

Takeaway: just put HTTPS on, stop overthinking

If you self-host any web tool (Flask, Node, Go, whatever), do it today:

• ZeroSSL is free, 90 days, auto-renewable. No excuse.
• Mobile blocking is silent. You won't see it. Users won't tell you. They'll just leave.
• The green padlock is a trust signal. Users with the lock are more willing to register.

Next week I'll write "How HTTPS encryption works, explained to my mom in 5 min." If you want the ZeroSSL renewal SOP, leave a comment.

Want to try the SSL-equipped PRO tool yourself? Head to our PHD tool page or check the 30-day real combat diary to see it in action.