Claude Studio v1.18.6

It was never the certificate

Chrome verified the issuer and still called the page insecure — because the page contained resources loaded over plain http. Mixed content withdraws precisely what the certificate was installed for: no service worker, no Install app, no notifications, and a missing padlock as the only visible symptom.

• The secure listener now sends upgrade-insecure-requests, so a stray http subresource is fetched over https instead of poisoning the page — whatever wrote the URL.
• The app reports any resource it loaded over http to the Mac's bridge log. The browser knows which one it was; a phone has no console to ask it from.