@@ -3,7 +3,11 @@
 /// <summary>
 ///     Web page of a host, see <see cref="WebPageResolver" />.
 /// </summary>
-/// <param name="URL">URL that answered (e.g. "https://192.168.1.1/").</param>
+/// <param name="URL">
+///     URL that was requested on the port that answered (e.g. "https://192.168.1.1/") - also after a redirect on the
+///     same host, so the Web Console opens the port (and scheme) that answered; the other values are of the last
+///     response.
+/// </param>
 /// <param name="StatusCode">HTTP status code of the (last) response, e.g. 200.</param>
 /// <param name="Title">Title of the web page, empty if it has none (e.g. a redirect to another host).</param>
 /// <param name="Server">Value of the <c>Server</c> header (e.g. "nginx"), empty if there is none.</param>
@@ -14,7 +18,10 @@
 /// <param name="RedirectURL">
 ///     Target of a redirect to another host (e.g. "https://unifi.local:8443/"), empty if there is none.
 /// </param>
-/// <param name="Certificate">TLS certificate of the web server, null for http.</param>
+/// <param name="Certificate">
+///     TLS certificate of the web server (of the last response), null for http (also after a redirect from https to
+///     http).
+/// </param>
 public sealed record WebPageInfo(
     string URL,
     int StatusCode,
 
@@ -159,9 +159,6 @@ public static string[] GetSchemes(int port)
     private static async Task<WebPageInfo> GetWebPageAsync(string url, int timeout,
         CancellationToken cancellationToken)
     {
-        // Certificate of the last https response (e.g. after a redirect from http to https)
-        WebCertificateInfo certificate = null;
-
         try
         {
             // In the try: an URL that can't be parsed only means no web page for this host, not the end of the scan
@@ -180,8 +177,11 @@ private static async Task<WebPageInfo> GetWebPageAsync(string url, int timeout,
                 using var response = await Client.SendAsync(request, HttpCompletionOption.ResponseHeadersRead,
                     linkedCts.Token).ConfigureAwait(false);
 
-                if (request.Options.TryGetValue(CertificateKey, out var requestCertificate))
-                    certificate = requestCertificate;
+                // Certificate of this response (e.g. after a redirect from http to https), null for http (also after a
+                // redirect from https to http)
+                var certificate = request.Options.TryGetValue(CertificateKey, out var requestCertificate)
+                    ? requestCertificate
+                    : null;
 
                 var statusCode = (int)response.StatusCode;
                 var server = CleanHeaderValue(response.Headers.Server.ToString());
 
@@ -420,7 +420,7 @@ Timeout in milliseconds after which an mDNS request is considered lost.
 
 ### Read web pages
 
-Read the web page (`GET /`) of every reachable host with an open port of the [Ports](#ports-1) below: status code, title, the `Server` and `X-Powered-By` headers, the realm of a login prompt (`WWW-Authenticate` header of a `401` response, e.g. `RT-AC68U` - routers, cameras and printers often name their model there) the target of a redirect to another host (e.g. `https://unifi.local:8443/`) and, for https, the TLS certificate: subject, issuer (`Self-signed` for a self-signed certificate) and the end of the validity (`(expired)` if it is expired). The title is shown in the **Web** column (the URL in the tooltip), all values in the **Web** section of the row details. The ports are tried in the order of the list, the first one that answers is used: https on `443` and `8443`, http on `80` and `8080`, https and then http on any other port. On ports other than `443` / `8443`, the https attempt waits at most 1 second (also with a higher timeout), so a plain http device that doesn't answer the TLS handshake doesn't cost the whole timeout before http is tried. Redirects on the same host (e.g. http to https, `/` to `/login.html`) are followed. If the page has no title, the column shows the realm, the `Server` header (e.g. `nginx`) or the redirect target. The values are in the search and the export (`WebStatusCode`, `WebServer`, `WebPoweredBy`, `WebRealm`, `WebRedirectURL`, `WebCertificateSubject`, `WebCertificateIssuer`, `WebCertificateNotAfter`, `WebCertificateSelfSigned`). **Web Console** in the context menu opens the port (and scheme) that answered.
+Read the web page (`GET /`) of every reachable host with an open port of the [Ports](#ports-1) below: status code, title, the `Server` and `X-Powered-By` headers, the realm of a login prompt (`WWW-Authenticate` header of a `401` response, e.g. `RT-AC68U` - routers, cameras and printers often name their model there) the target of a redirect to another host (e.g. `https://unifi.local:8443/`) and, for https, the TLS certificate: subject, issuer (`Self-signed` for a self-signed certificate) and the end of the validity (`(expired)` if it is expired). The title is shown in the **Web** column (the URL in the tooltip), all values in the **Web** section of the row details. The ports are tried in the order of the list, the first one that answers is used: https on `443` and `8443`, http on `80` and `8080`, https and then http on any other port. On ports other than `443` / `8443`, the https attempt waits at most 1 second (also with a higher timeout), so a plain http device that doesn't answer the TLS handshake doesn't cost the whole timeout before http is tried. Redirects on the same host (e.g. http to https, `/` to `/login.html`) are followed, the values (also the certificate) are those of the last response. If the page has no title, the column shows the realm, the `Server` header (e.g. `nginx`) or the redirect target. The values are in the search and the export (`WebStatusCode`, `WebServer`, `WebPoweredBy`, `WebRealm`, `WebRedirectURL`, `WebCertificateSubject`, `WebCertificateIssuer`, `WebCertificateNotAfter`, `WebCertificateSelfSigned`). **Web Console** in the context menu opens the port (and scheme) that answered.
 
 **Type:** `Boolean`