On the Actions tab of a ScreenlyOS screen: Download certificate for that device’s own certificate, and Download CA certificate for the authority that signed it.
What they are for
Every ScreenlyOS device holds a client certificate, which is how it proves who it is to us. You can use the same certificate to let the device prove who it is to your services, so an internal dashboard can require a certificate rather than a shared password.
That is the mutual TLS setup described in Authenticated pages, which has the server-side configuration and has to be enabled per content item.
Verify on the device, not just the CA
Every Screenly device shares the same certificate authority. A service that only checks that a client certificate chains to the Screenly CA is trusting any Screenly player in the world, not just yours.
Check the certificate’s common name as well. On a device certificate the common name is that device’s own id, so your service can allow the specific players you mean and refuse the rest.
The CA certificate is the one your service needs in order to validate the chain at all. The device certificate is what tells you which device it is.