fix ipps certificate lookup

README.md

@@ -140,8 +140,18 @@ FQDN, `localhost`, `127.0.0.1` and everything in `CERT_EXTRA_NAMES`:
 The certificate lives in `/etc/cups/ssl` (so that directory must be writable:
 use a named volume, see the bind-mount caveat under *Notes and limitations*)
 and is only regenerated when one of the names it must cover is missing, so a
-restart normally logs `TLS certificate is up to date`. Inspect what the server
-actually presents:
+restart normally logs `TLS certificate is up to date`.
+
+It is also copied — as `<name>.crt`/`<name>.key` — for every name CUPS may look
+it up by, because CUPS 2.4 does not choose the certificate by the name the client
+requested: it reverse-resolves the *local* address the client connected to and
+loads `<name>.crt` from `/etc/cups/ssl`. A host-networked container resolves its
+own LAN address to the name Podman writes into `/etc/hosts`
+(`host.containers.internal`), and IPv6 literals are used as-is, so those names
+need a copy too. Otherwise CUPS mints a certificate of its own for the address,
+whose SANs do not cover the advertised `.local` name.
+
+Inspect what the server actually presents:
 
 ```sh
 podman cp printserver:/etc/cups/ssl/server.crt .