Fixed issue with shelly self signed certificate.

docs/operations.md

@@ -157,10 +157,10 @@ groups:
 ## Security
 
 - Store `config.yaml` outside source control and restrict it to the exporter account, for example with mode `0600` on Linux.
-- Prefer a trusted management network or HTTPS because Basic Authentication does not encrypt credentials over plain HTTP.
+- Prefer a trusted management network. HTTPS encrypts credentials in transit, but the exporter does not verify device certificates and therefore does not authenticate the remote endpoint.
 - The exporter endpoints themselves do not require authentication. Restrict port 9090 with firewall, reverse proxy, or network policy when necessary.
 - Device passwords are not metric labels, but request failures can include the target URL in logs. Do not put credentials in URL user-info; use `username` and `password` fields.
-- HTTPS certificate verification is enabled and cannot be bypassed by configuration.
+- HTTPS device certificates are not verified. Restrict device traffic to a trusted network to reduce man-in-the-middle risk.
 
 ## Troubleshooting
 
@@ -193,7 +193,7 @@ Confirm that the configured username and password match the device. The exporter
 
 ### TLS certificate error
 
-The device certificate must be trusted by the exporter operating system or container. Use a certificate issued by a trusted internal CA and add that CA to the runtime trust store.
+The exporter deliberately ignores certificate validity for HTTPS device connections, including trust, expiry, and hostname checks. A certificate validation error therefore indicates that an older exporter build may still be running; update and restart it. Other TLS errors, such as unsupported protocol versions or cipher suites, are not certificate validation errors and can still fail the scrape.
 
 ### Device is up but an expected metric is absent