HTTPS and certificates

Configure the shared server identity for the Web console and HTTPS proxy, establish client trust, and plan certificate renewal separately from configuration backups.

Create or import on the Mac

Enterprise Settings requires an Enterprise license. HTTPS encrypts its listener; it does not replace administrator or proxy authentication.

1. Open General → Enterprise Settings. Stop the Local API and HTTPS proxy before changing the certificate.
2. Choose Generate HTTPS certificate… for a local CA and server certificate, or import a PKCS#12 server identity (.p12/.pfx) with its password. The bundle must include the matching server private key; never distribute it to clients.
3. Include the exact DNS names/IPs clients will use. Enter names only, without a scheme, port or path; keep loopback names for local access. An IP change may require a new certificate.
4. With a local CA, choose Export local CA… and install/trust only that public certificate on each client. Do not distribute the CA private key. The App does not change system trust automatically.
5. Restart the API and open its displayed https://…:10790/admin address (or your saved port). Verify certificate trust and the connection name; do not bypass warnings.

Enable the separate HTTPS proxy

Start transparent proxying and Network Sharing in Proxy Mode. Select the HTTPS proxy’s address and unused TCP port (default 10792), then enable it and confirm Running. Turn it off before editing its address or port. Clients must support an HTTPS proxy and trust its certificate; basic Wi-Fi HTTP proxy settings are not necessarily compatible.

HTTP/SOCKS and HTTPS share proxy credentials. Multi-user access requires authentication; without it, HTTPS can be anonymous if authentication is explicitly disabled. TLS does not make anonymous access safe. The existing HTTP/SOCKS listener remains separate and unencrypted; HTTPS proxying does not add UDP/QUIC or intercept website certificates.

Renew and recover

The Web Settings certificate controls require owner authorization and a trusted transport: local loopback or HTTPS. Changes are staged; restart each affected service on the Mac to apply them. Prefer renewing with the existing local CA; replacing it requires clients to trust the new CA again.

No certificate means the management service can use HTTP/WS, while the HTTPS proxy cannot start. A configured invalid, expired or unreadable identity blocks startup instead of silently downgrading. Recover through the Mac’s certificate controls and check names, dates, Keychain access and port conflicts.

TLS identities and CA private keys are excluded from configuration backups. Keep a separate secure recovery plan. Read risks and safeguards before widening access.