get.telimatic.com

Install scripts and public files for Telimatic teammates.

This page hosts a script that makes your laptop trust the Telimatic internal root CA, so *.telimatic.internal addresses (internal dashboards, monitoring, admin tools) open in your browser without a security warning. Everything on this site is public and reviewable — see the source repository.

Status: these scripts are UNTESTED on real macOS and Windows machines as of 2026-09-20. --show is safe to run anywhere first — it only downloads and inspects the certificate and changes nothing. See the README for what has and has not been verified before you rely on the install step.

Install

macOS or Linux:

curl -fsSL https://get.telimatic.com/ca/install.sh | bash

Windows (PowerShell):

irm https://get.telimatic.com/ca/install.ps1 | iex

Both scripts download the certificate themselves, verify its SHA-256 fingerprint against the value pinned inside the script, print the certificate's subject, expiry and name constraint, and refuse to install anything if the fingerprint does not match. Add --show (shell) or run the scriptblock form with -Show (PowerShell, see the README) to inspect without installing, and --uninstall / -Uninstall to remove it later.

The certificate

Subject	O = Telimatic, CN = Telimatic Internal Root CA
Key	ECDSA P-384
Valid	2026-07-10 → 2126-07-10
Name constraint	critical, permitted: `DNS:telimatic.internal`

SHA-256 fingerprint:

4A:10:7F:F1:53:74:4D:A6:4C:70:DD:19:F5:1E:E9:F6:22:19:06:98:6F:E3:FB:D1:13:AE:18:01:95:C2:6C:79

What trusting this CA means

This certificate carries a critical X.509 name constraint permitting only DNS:telimatic.internal. A correct TLS client that trusts this CA will accept certificates it signs only for names ending in telimatic.internal — it cannot vouch for google.com, your bank, or your employer's real domain. Because the constraint is marked critical, a client that does not understand name constraints must reject the certificate outright rather than ignore the limit.

Whoever controls this CA's private key can mint a certificate for any *.telimatic.internal name. That key lives only in three regional Oracle Cloud vaults — never in this script, this repository, or on any laptop. That is the same trust you already place in Telimatic's internal services; it does not extend past telimatic.internal.

Firefox is not covered. It ships its own trust store. Set security.enterprise_roots.enabled to true in about:config, or import the certificate by hand under Settings → Privacy & Security → Certificates → Authorities.

Uninstall

macOS or Linux:

curl -fsSL https://get.telimatic.com/ca/install.sh | bash -s -- --uninstall

Windows (PowerShell):

& ([scriptblock]::Create((irm https://get.telimatic.com/ca/install.ps1))) -Uninstall

Both scripts read the removal back and say so if something else — an MDM profile, Group Policy — is putting the certificate back.