- Add /api/nixclient/ssl (GET) — returns certs for authenticated user only - Add /api/nixclient/ssl/:id/renew (POST) — validates cert belongs to user - Register sslRoutes in nixclient index.ts - nixclient SSL.tsx was calling /nixserver/ssl (requireAdminOrReseller) which would always 401 for regular users — fixed to /nixclient/ssl