export interface TlsFiles {
    cert: string;
    key: string;
    /** Path to CA certificate, if generated via mkcert. Users install this to trust the cert. */
    caCert?: string;
}
/**
 * Ensure a TLS certificate exists for the given host IP.
 *
 * Strategy:
 *   1. Try mkcert (npm package) — generates a local CA + cert trusted by browsers
 *      once the CA cert is installed on the device.
 *   2. Fall back to openssl self-signed cert (existing behavior).
 *
 * Returns paths to the cert, key, and optionally the CA cert.
 */
export declare function ensureTlsCert(host: string, extraDomains?: string[]): Promise<TlsFiles>;
//# sourceMappingURL=tls.d.ts.map