"Not secure", even after the certificate is installed
Chrome remembers a Proceed anyway for an address. Once you have tapped through the warning — which anyone does while the certificate really is broken — the page keeps its degraded state afterwards: no padlock, no service worker, no Install app, and Add to Home screen can only make a shortcut. Nothing tells you that the state is a memory rather than a fact, so every fix aimed at the certificate appears to change nothing.
The setup page now explains it and gives the test that tells the two apart:
- Open the page in an Incognito tab — it carries none of that memory. A padlock there means the setup is sound.
- Then clear the old decision: address-bar warning → Site settings → Clear & reset, and come back through the QR code (the reset takes the token cookie with it).