0.15.0 - bring your own certificate
Since 0.11.0 the device has been its own certificate authority, which works well if you are willing to import that authority once per machine. In an organisation that already runs its own CA, or on a device that has a real name and a real public certificate, importing anything is the wrong answer.
So you can now install your own. Upload one PEM blob - the certificate chain first, then the private key, which is exactly what cat fullchain.pem privkey.pem gives you - and the device serves the console with it. Delete it and the device goes back to the identity it makes for itself.
Two things make this safe to try on a device you cannot walk to: the pair is checked before it is stored, both that it parses and that the key really belongs to the certificate; and if the TLS stack still refuses it at start-up, the server falls back to the self-signed certificate rather than not coming up. A bad upload cannot lock you out of the console.