diff --git a/pkg/service/handlers/server.go b/pkg/service/handlers/server.go
index 3f7d3b4..9d29ae7 100644
--- a/pkg/service/handlers/server.go
+++ b/pkg/service/handlers/server.go
@@ -109,6 +109,10 @@ func NewServer(ds *datastore.DataStore, sm *setup.Manager, serverURL string, red
 	health.RegisterSpeakerInfoReachable(s.healthRegistry, ds)
 	health.RegisterSourcesXMLDiff(s.healthRegistry, ds)
 	health.RegisterSpeakerMargeURLCheck(s.healthRegistry, ds, s.ExpectedHosts)
+	health.RegisterCertChainCheck(s.healthRegistry, func() string {
+		_, httpsURL := s.GetSettings()
+		return httpsURL
+	})
 
 	return s
 }
diff --git a/pkg/service/health/checks_cert_chain.go b/pkg/service/health/checks_cert_chain.go
new file mode 100644
index 0000000..0727f7b
--- /dev/null
+++ b/pkg/service/health/checks_cert_chain.go
@@ -0,0 +1,159 @@
+package health
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"net"
+	"net/url"
+	"strings"
+	"time"
+)
+
+// CheckIDCertChain is the registry id of the cert-chain probe.
+const CheckIDCertChain = "service_cert_chain"
+
+// RegisterCertChainCheck registers a check that dials the
+// configured HTTPS endpoint and reports whether its certificate
+// chain validates against the system trust store. Three outcomes:
+//
+//   - validates against system roots → no finding (the
+//     speaker's firmware ships with the major roots, so a public-
+//     CA chain such as Let's Encrypt is usable directly).
+//   - chain doesn't validate → warning, with a note that
+//     `install-ca` is the fix when AfterTouch is using its own
+//     self-signed CA, or "review the proxy / ingress cert" when
+//     the chain looks foreign.
+//   - HTTPS URL not configured → skip silently.
+//
+// httpsURLFn is a closure so config changes are picked up at run
+// time (today only at restart, but cheap to keep flexible).
+func RegisterCertChainCheck(r *Registry, httpsURLFn func() string) {
+	r.Register(Check{
+		ID:    CheckIDCertChain,
+		Title: "HTTPS endpoint certificate validates",
+		Run: func() []Finding {
+			return runCertChainCheck(httpsURLFn())
+		},
+	})
+}
+
+func runCertChainCheck(httpsURL string) []Finding {
+	if strings.TrimSpace(httpsURL) == "" {
+		return nil
+	}
+
+	host, port := splitHTTPSHostPort(httpsURL)
+	if host == "" {
+		return []Finding{{
+			Severity: SeverityWarning,
+			Message:  fmt.Sprintf("Configured HTTPS URL %q is not parseable.", httpsURL),
+		}}
+	}
+
+	addr := net.JoinHostPort(host, port)
+
+	dialer := &net.Dialer{Timeout: 2 * time.Second}
+
+	// Phase 1: try with the system trust store. ServerName is set
+	// from the URL so the verifier checks SAN coverage too.
+	conn, err := tls.DialWithDialer(dialer, "tcp", addr, &tls.Config{
+		ServerName: host,
+		MinVersion: tls.VersionTLS12,
+	})
+	if err == nil {
+		_ = conn.Close()
+		return nil // validates against system roots
+	}
+
+	// Phase 2: re-dial with InsecureSkipVerify so we can read the
+	// chain and report what was actually served.
+	insecureConn, insecureErr := tls.DialWithDialer(dialer, "tcp", addr, &tls.Config{
+		ServerName:         host,
+		InsecureSkipVerify: true,
+		MinVersion:         tls.VersionTLS12,
+	})
+	if insecureErr != nil {
+		return []Finding{{
+			Severity: SeverityError,
+			Message:  fmt.Sprintf("Could not connect to %s: %v", addr, insecureErr),
+			Details:  "AfterTouch's HTTPS endpoint isn't reachable from inside the service. Check that the listener is bound and the URL host:port resolves correctly.",
+		}}
+	}
+	defer func() { _ = insecureConn.Close() }()
+
+	peers := insecureConn.ConnectionState().PeerCertificates
+	if len(peers) == 0 {
+		return []Finding{{
+			Severity: SeverityWarning,
+			Message:  "HTTPS endpoint connected but presented no certificates.",
+		}}
+	}
+
+	leaf := peers[0]
+
+	subject := leaf.Subject.String()
+	issuer := leaf.Issuer.String()
+	notAfter := leaf.NotAfter.Format("2006-01-02")
+
+	dnsNames := strings.Join(leaf.DNSNames, ", ")
+	if dnsNames == "" {
+		dnsNames = "(none)"
+	}
+
+	details := fmt.Sprintf(
+		"Verification error: %v. Leaf subject: %s. Issuer: %s. SANs: %s. Expires: %s.",
+		err, subject, issuer, dnsNames, notAfter,
+	)
+
+	var hints []ManualCommand
+
+	if leafLooksSelfSigned(leaf) {
+		hints = append(hints, ManualCommand{
+			Label:   "If this is AfterTouch's built-in CA, install it on each speaker:",
+			Command: "soundtouch-cli --host=<speaker-ip> setup install-ca --service-url=" + httpsURL,
+			Hint:    "Requires SSH on the speaker. After install, re-run this check.",
+		})
+	} else {
+		hints = append(hints, ManualCommand{
+			Label:   "Investigate the chain manually:",
+			Command: fmt.Sprintf("openssl s_client -connect %s -servername %s -showcerts </dev/null", addr, host),
+			Hint:    "Run from the same host as the service. Shows the full chain the peer is serving.",
+		})
+	}
+
+	return []Finding{{
+		Severity:       SeverityWarning,
+		Message:        fmt.Sprintf("HTTPS certificate at %s does not validate against system roots.", addr),
+		Details:        details,
+		ManualCommands: hints,
+	}}
+}
+
+func splitHTTPSHostPort(raw string) (string, string) {
+	u, err := url.Parse(raw)
+	if err != nil || u.Hostname() == "" {
+		return "", ""
+	}
+
+	host := u.Hostname()
+
+	port := u.Port()
+	if port == "" {
+		port = "443"
+	}
+
+	return host, port
+}
+
+// leafLooksSelfSigned reports whether the leaf certificate's
+// Subject and Issuer match — a strong hint that we're looking at
+// AfterTouch's own self-signed CA-issued cert rather than a public
+// CA chain. This is intentionally a heuristic, not a guarantee.
+func leafLooksSelfSigned(leaf *x509.Certificate) bool {
+	if leaf == nil {
+		return false
+	}
+
+	return leaf.Subject.String() == leaf.Issuer.String()
+}
diff --git a/pkg/service/health/checks_cert_chain_test.go b/pkg/service/health/checks_cert_chain_test.go
new file mode 100644
index 0000000..4fd7255
--- /dev/null
+++ b/pkg/service/health/checks_cert_chain_test.go
@@ -0,0 +1,137 @@
+package health
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"math/big"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestCertChain_EmptyURLSkips(t *testing.T) {
+	got := runCertChainCheck("")
+	if len(got) != 0 {
+		t.Errorf("expected no findings for empty URL, got %+v", got)
+	}
+}
+
+func TestCertChain_UnparseableURLWarns(t *testing.T) {
+	got := runCertChainCheck("://nope")
+	if len(got) != 1 || got[0].Severity != SeverityWarning {
+		t.Fatalf("expected one warning, got %+v", got)
+	}
+}
+
+func TestCertChain_UnreachableEndpoint(t *testing.T) {
+	// 127.0.0.1:1 refuses; using https:// to force TLS path.
+	got := runCertChainCheck("https://127.0.0.1:1/")
+	if len(got) != 1 || got[0].Severity != SeverityError {
+		t.Fatalf("expected one error for unreachable endpoint, got %+v", got)
+	}
+}
+
+func TestCertChain_SelfSignedFlagsAndSuggestsInstallCA(t *testing.T) {
+	srv := newSelfSignedTLSServer(t)
+	defer srv.Close()
+
+	// httptest's TLS URL uses 127.0.0.1; the test cert below uses
+	// "127.0.0.1" as SAN, so SNI matches but the chain is
+	// self-signed and won't validate against system roots.
+	got := runCertChainCheck(srv.URL)
+	if len(got) != 1 || got[0].Severity != SeverityWarning {
+		t.Fatalf("expected one warning for self-signed cert, got %+v", got)
+	}
+
+	if !strings.Contains(got[0].Details, "Issuer") {
+		t.Errorf("expected issuer detail, got %q", got[0].Details)
+	}
+
+	if len(got[0].ManualCommands) == 0 {
+		t.Fatalf("expected at least one manual command, got none")
+	}
+
+	cmd := got[0].ManualCommands[0].Command
+	if !strings.Contains(cmd, "install-ca") {
+		t.Errorf("expected install-ca suggestion for self-signed cert, got %q", cmd)
+	}
+}
+
+func TestSplitHTTPSHostPort(t *testing.T) {
+	cases := []struct {
+		in, host, port string
+	}{
+		{"https://example.com/", "example.com", "443"},
+		{"https://example.com:8443/", "example.com", "8443"},
+		{"https://192.0.2.10/", "192.0.2.10", "443"},
+		{"https://", "", ""},
+		{"://broken", "", ""},
+	}
+
+	for _, c := range cases {
+		h, p := splitHTTPSHostPort(c.in)
+		if h != c.host || p != c.port {
+			t.Errorf("splitHTTPSHostPort(%q) = (%q, %q), want (%q, %q)", c.in, h, p, c.host, c.port)
+		}
+	}
+}
+
+// newSelfSignedTLSServer returns an httptest.Server whose TLS
+// config uses a self-signed cert we generate inline. httptest's
+// default TLS server uses a built-in cert, but verifying its
+// Subject == Issuer property without inspecting innards is
+// fiddly; making our own keeps the assertion deterministic.
+func newSelfSignedTLSServer(t *testing.T) *httptest.Server {
+	t.Helper()
+
+	cert := generateSelfSignedCert(t)
+
+	srv := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(200)
+	}))
+	srv.TLS = &tls.Config{Certificates: []tls.Certificate{cert}}
+	srv.StartTLS()
+
+	return srv
+}
+
+func generateSelfSignedCert(t *testing.T) tls.Certificate {
+	t.Helper()
+
+	// Use ecdsa via x509 helpers — but keep it simple with a tiny
+	// RSA key from the test. Actually use crypto/rand + ed25519
+	// would be cleaner; for parity with stdlib examples, use the
+	// built-in helper path.
+	template := &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: "aftertouch-test"},
+		Issuer:       pkix.Name{CommonName: "aftertouch-test"}, // self-signed
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(time.Hour),
+		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},
+		DNSNames:     []string{"127.0.0.1"},
+		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("rsa key: %v", err)
+	}
+
+	derBytes, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	if err != nil {
+		t.Fatalf("create cert: %v", err)
+	}
+
+	return tls.Certificate{
+		Certificate: [][]byte{derBytes},
+		PrivateKey:  key,
+	}
+}