Every edge port serves HTTPS from goca's self-issued chain, and most "TLS problems" are trust problems wearing a disguise.
Browser warns about a self-signed certificate — either the infra root is not trusted yet (fetch GET /infra/trust, import it), or a listener is on its bootstrap fallback: check the Edge TLS board, which names the affected instance.
Still ERR_CERT_AUTHORITY_INVALID after importing — two traps. Wrong store: on Windows, "Enterprise Trust" is never consulted; the root belongs in Trusted Root Certification Authorities. Wrong certificate: /infra/trust serves the self-signed root — importing the issuing CA leaves the chain ending at an anchor nothing trusts. Check subject equals issuer on what you imported, and restart the browser fully.
The certificate changes on every restart — by design: the service key is generated per certificate and lives only in process memory. That is not why the browser warns; the root is stable, and trusting it once covers every future certificate.
Alert: serving an ephemeral certificate — self-issuance never completed: database unreachable at boot, or wrong master secret. Serving continues; fix the cause and the loop swaps within a minute.
Now I can tell an untrusted root from a broken listener.