# Web server certificate

By default, the device uses a self-signed certificate for the HTTPS communication to the browser. The browser does not trust the self-signed certificate and warns of an insecure connection when the IP address of the device is entered.

It is recommended to upload a custom certificate that is trusted by the browser. The custom certificate and the private key are required in PEM format.

Private keys encrypted with a password or pin are not supported. Please use an unencrypted private key.

If you use a custom certificate, your certificate signing request (CSR) must be signed by a certificate authority (CA) that your browser trusts. You can either give the CSR to a well-known CA your browser trusts by default or use a custom CA to sign your CSR.

A custom certificate is not automatically renewed when it expires. Make sure to upload a new custom certificate before expiry.