@hambier @dlakelan From my exp. automated (non-)inspection is done by several vendors in their default policy based on the reputation. So indeed selfhosted sites may be impacted more often by what you noticed. I have never seen filtering based on cert issuer (although of course technically possible). According to not verified sources LE has currently a market share well above some commercial CAs, not a geek-only thing for selfhosters anymore. In my opinion there’s no reason to change your cert.

@hambier @dlakelan A TLS certificate is not a warranty that your traffic won't be intercepted, it's just a way to notice that this happened. A paid certificate will not change anything… if the inspecting transparent proxy wants to intercept the traffic it will also do the same when you are using any other certificate issuer. For whatever reason it wants to do it (or just maybe just a misconfiguration) …

@hambier I'm using a Canon GX-7050. Since it's an ink-based device, it's probably not the best choice if you are not using it for longer periods. As others have noticed here, it's indeed also cleaning the heads (and filling up the maintenance cartridge with ink) when only used as a scanner. Please note that for setting up the network share config you have to use a Windows application (may work with Wine, haven't tried it). Otherwise I'm happy with it.