Minor docs updates

Author: webprofusion-chrisc

docs/hub/guides/ccm.md

@@ -26,7 +26,7 @@ The management hub will have complete control over the Certify Certificate Manag
 
 ## Joining the Hub
 
-By default a joining API key is created when you install the hub. This is found under Settings > Security > API Access. You will need the API URL, Client Id and Client Secret values.
+By default a joining API key is created when you install the hub. This is found under *Settings > Security > API Access*. You will need the API URL (e.g. `https://hub.internal.yourdomain.com:9697` depending on your configuration), Client Id and Client Secret values.
 
 ### Method 1: Using the Desktop User Interface
 
@@ -54,7 +54,7 @@ After joining, confirm that your instance appears in the Management Hub UI's **I
 
 # Using the Hub to manage a CCM instance
 
-Your *Certify Certificate Manager* install remains much the same as it was before, except it can also be externally managed via the hub. When you are working with individual setting such as Stored Credentials, Certificate Authority accounts etc these remain per-instance settings, so each instance of the app has it's own set of settings and you will selected the target instance when working with those. 
+Your existing *Certify Certificate Manager* install remains much the same as it was before, except it can also be externally managed via the hub. When you are working with individual settings such as Stored Credentials, Certificate Authority accounts etc these remain per-instance settings, so each instance of the app has it's own set of settings and you will selected the target instance when working with those. 
 
 The hub does not currently have global settings that can be pushed to all managed instances etc (such as a single ACME account, or specific stored credential).
 

docs/hub/installation/service.md

@@ -14,7 +14,7 @@ An example config is included in the file to use a PFX file, so to setup https:
 
 - Decide on your preferred fully qualified service name for the hub, e.g. `certifyhub.intranet.yourdomain.com`
 - Use the management hub to acquire a certificate for the service name you need, using the normal certificate request process.
-- Add a Deployment Task (Export Certificate) to export a PFX (PKCS#12) file to where it's required e.g. C:\ProgramData\certify\internal-certs\hub.pfx , then run the task to export the initial certificate.
+- Add a Deployment Task (*Export Certificate*) to export a PFX (PKCS#12) file to where it's required e.g. C:\ProgramData\certify\internal-certs\hub.pfx , then run the task to export the initial certificate.
 
 Once you have a cert on disk you are ready to configure the service to use that cert file, edit the `hubservice.json` file to include the `HttpsInlineCertFile` entry. The choice of port and filename etc is arbitrary, as long as the process can access the file.:
 
@@ -35,6 +35,8 @@ Once you have a cert on disk you are ready to configure the service to use that
   }
   ```
 
-Then restart the `Certify Management Hub` service, you can then access the service via https e.g. `https://certifyhub.intranet.yourdomain.com`
+Then restart the `Certify Management Hub` service, you can then access the service via https at the port you specified e.g. `https://certifyhub.intranet.yourdomain.com:9697` - do not expose your installation (e.g. open the port) to the public internet.
 
-This is an example configuration, so you can configure the endpoints and certificates however you prefer.
+This is an example configuration, so you can configure the endpoints and certificates however you prefer.
+
+Note that when using the app remotely the UI (e.g. via Tailscale etc) may take a while to load the WASM files etc for the first time, subsequent loads are much faster.

docs/hub/installation/windows.md

@@ -19,7 +19,7 @@ The current default configuration will make the service and UI available at `htt
 
 To use the service with https you can either [configure the service to use https](service.md) or reverse proxy the service from a webserver of your choice (Caddy, IIS, nginx, Apache etc and administer https on those as normal).
 
-Do not install the Hub service where you also want to use Certify Certificate Manager as they will share the same settings/databases via different services which could create confusion or conflicts and is not a supported configuration. You can however upgrade a Certify Certificate Manager install to be a hub: uninstall Certify Certificate Manager (the desktop app_ first, install Certify Management Hub, then use the hub to administer your certificates as normal.
+Do not install the Hub service where you also want to use Certify Certificate Manager as they will share the same settings/databases via different services which could create confusion or conflicts and is not a supported configuration. You can however upgrade a Certify Certificate Manager install to be a hub: uninstall Certify Certificate Manager (the desktop app) first, install Certify Management Hub, then use the hub to administer your certificates as normal.
 
 ### Settings are preserved between installs/upgrades
 On Windows your settings are preserved in `%PROGRAMDATA%\certify`. For most users, this is `C:\ProgramData\certify`. Uninstalling the app or installing a new version does not remove the files stored here. We recommend including this location in your regular backup procedure.

docs/hub/managedchallenges.md

@@ -57,7 +57,7 @@ Under *Settings > Security > API Access*, select Add API Token, select the requi
 8. Copy the **Client ID** and **Secret** values - you'll need these for instance configuration
 
 #### Combined Hub joining and Managed Challenge Key
-It is possible to create a combined hub joining key and managed challenge key, which certain clients (such as Certify Certificate Manager) can use by default if they already know the hub joining key. This is provided as an option for convinience but is not configured by default. 
+It is possible to create a combined hub joining key and managed challenge key, which certain clients (such as Certify Certificate Manager) can use by default if they already know the hub joining key. This is provided as an option for convenience but is not configured by default. 
 
 To enable this, add the Managed Challenge Consumer role to the managed instance service principle (or a new service principle), then create a new hub joining key with both the *Hub Managed Instance* role and *Managed Challenge Consumer* role scope.