Z-Wave JS UI 11.25.2 came out on 26 October 2026 with one real fix. Since 11.25.0, some installations with HTTPS turned on would not start at all: the Docker container restarted over and over and the log showed ERR_SSL_EE_KEY_TOO_SMALL ("ee key too small"). The new version repairs most of those setups on its own, but it also makes the custom certificate settings stricter.

Why the update to 11.25.0 broke HTTPS

Version 11.25.0 moved the Docker image to Node 24. Node 24 runs OpenSSL at security level 2 by default, which rejects RSA keys shorter than 2048 bits. Before v9.29.0, Z-Wave JS UI generated its self-signed certificate with a 1024-bit key, and it only created a new one when the files were missing from the store. Anyone who enabled HTTPS before that version still had the old key. Node 22 accepted it, Node 24 did not, and since nothing caught the error, the process exited at startup. The problem was reported on 22 October.

What 11.25.2 does now

Before starting the server, the app checks the certificate and key with the same test Node itself applies. What happens next depends on where the pair comes from:

  • A self-signed pair in the store that Node rejects is renamed to cert.pem.bak and key.pem.bak, a new 2048-bit pair is generated and a warning goes to the log. For most people this is the whole fix: update and HTTPS works again. If you told your browser to trust the old certificate, expect a warning again, because this is a new one.
  • A custom pair set with SSL_CERTIFICATE and SSL_KEY that Node rejects stops startup with an error that names both files, gives the OpenSSL reason and says how to fix it. The app never swaps your own certificate for a self-signed one or for plain HTTP.
  • A custom file that is missing, unreadable or empty now stops startup too. Before, the app quietly served a self-signed certificate instead.
  • Setting only one of SSL_CERTIFICATE and SSL_KEY stops startup. Set both or neither.

That last group is a behaviour change. A setup that started only thanks to the old fallback, for example with a stale certificate path, will fail after the update until the path is corrected or both variables are removed.

Two smaller changes come with the fix. A regenerated key.pem gets 0600 permissions, because older key files could stay readable by everyone (0644). The "Listening on" log line now shows the protocol actually in use; before, it said HTTPS even after falling back to HTTP.

The release also updates the multer dependency to 2.5.0. The previous patch, 11.25.1 from 23 October, moved to zwave-js 15.31.2 and Node 24.22.1 but did not touch certificates. If you skipped 11.25.x because of the restart loop, 11.25.2 is the version to go to.