{"wiki":"en","slug":"guide-general-webservercertificate","markdown":"# Using Your Own Certificate for the Web Server\n\nThis setup guide describes how to upload your own web server certificate to the Behnke Station and switch access to the web interface to a secure connection.\n\nThe web interface can be accessed via HTTP (unsecured connection) or HTTPS (secured connection). To avoid security risks, the use of HTTPS is recommended. By default, no custom certificate is uploaded (the Behnke Station then uses its internal certificate). Because this certificate is not known to the browsers accessing the station, they display a certificate warning when accessing it via HTTPS.\n\nWith your own web server certificate issued by a certification authority that is trusted in your network, this warning no longer appears.\n\n> [!NOTE]\n> As long as the web interface is accessed via HTTP, the login page indicates under **SECURITY NOTICE** that the connection is not secured, and offers the **Use secure connection** button.\n\n> [!NOTE]\n> As long as the web interface is accessed via HTTP, the login page indicates under **SECURITY NOTICE** that the connection is not secured, and offers the **Use secure connection** button.\n\n%[NOTE_REQUIRES_BASIC_SETUP](NOTE_REQUIRES_BASIC_SETUP)%\n\n\n## 1. Requirements for the Certificate File\n\nThe Behnke Station expects the web server certificate in **PEM format**. You need **one** file that contains exactly one certificate with an **unencrypted** private key.\n\n- exactly one certificate per file (**no certificate chains with multiple certificates**)\n- the private key is in the same file\n- the private key must not be encrypted with a passphrase\n\n> [!CAUTION]\n> The file contains the private key in plain text. Treat it as confidential and do not transmit it over insecure channels.\n\n> [!TIP]\n> Issue the certificate for the name under which the Behnke Station will later be accessed. If you access the station via its IP address, this must be included in the certificate (otherwise the browser will show a warning about a mismatched name despite the custom certificate).\n\n\n## 2. Uploading the Certificate\n\n%[BS_LOGIN_INFO](BS_LOGIN_INFO)%\n\n- Click the menu item %BS_MENU_ALLGEMEIN% in the sidebar on the left\n- Navigate to the **Web interface** section\n\n\n\nIn the **Web server certificate** row, the Behnke Station shows the current status. Without a custom certificate, it says **not uploaded** and **internal certificate is used**.\n\n\n\n- For the **Certificate** option, click **upload**\n- The file selection dialog of your browser opens\n- Select the prepared PEM file\n\nAfter the upload, the information about the certificate is displayed above in the **Web server certificate** row. Check there whether the expected certificate was accepted.\n\n\n\n- Click %BS_MENU_SPEICHERN_ROT% to save the configuration\n\n\n## 3. Setting Access to the Web Interface\n\nWith the **Access to the web interface** option in the **Web interface** section, you specify whether the web interface can also be reached via HTTP in addition to HTTPS.\n\n| Value | Meaning |\n| --- | --- |\n| **HTTP allowed** | The web interface can be reached via HTTP and via HTTPS. This is the default. |\n| **HTTP allowed if no certificate** | HTTP is only allowed as long as no custom certificate is uploaded. Once a certificate is present, the web interface can only be reached via HTTPS. |\n| **Use HTTPS** | The web interface can only be reached via HTTPS. |\n\n- Set the **Access to the web interface** option to the desired value\n- Click %BS_MENU_SPEICHERN_ROT% to save the configuration\n\n> [!NOTE]\n> Access via HTTPS is always possible. This option only controls whether access via HTTP is additionally allowed. You therefore cannot lock yourself out by disabling HTTP.\n\n> [!NOTE]\n> The option does not affect the retrieval of images or video streams. These can still be retrieved via HTTP, even if HTTPS must be used for the web interface.\n\n\n## 4. HTTPS Security\n\nAccess via HTTPS uses TLS with various encryption methods. With the **HTTPS security** option, you specify which methods are permitted.\n\n| Value | Meaning |\n| --- | --- |\n| **Standard encryption** | At least TLS 1.2 |\n| **Stronger encryption** | At least TLS 1.2 |\n| **Strongest encryption** | At least TLS 1.3 |\n\n- Set the **HTTPS security** option to the desired value\n- Click %BS_MENU_STORE_CHANGED% to save the configuration\n\n> [!WARNING]\n> Stronger encryption increases security, but may mean that HTTPS access is no longer possible with older web browsers. After changing the setting, check that the web interface can still be accessed with all browsers in use.\n\n\n## 5. Removing the Certificate\n\n- In the **Certificate** row, click **remove**\n- Click %BS_MENU_STORE_CHANGED% to save the configuration\n\nThe Behnke Station then uses its internal certificate again. The **Web server certificate** row then again shows **not uploaded**.\n\n> [!WARNING]\n> If the **Access to the web interface** option is set to **Use HTTPS**, the web interface remains reachable only via HTTPS even after removal (then again with the internal certificate and the corresponding certificate warning from the browser).\n\n\n## 6. FAQ\n\n\n> [!NOTE]\n> The browser shows a warning despite a custom certificate\n>\n> Check two points:\n>\n> - Is the issuing certification authority entered as trusted on the computer you are accessing from?\n> - Does the name or IP address you use to access the Behnke Station match the certificate?\n>\n> If either of the two does not match, the browser warns regardless of the fact that a custom certificate was uploaded.\n\n> [!NOTE]\n> How can I tell whether my certificate is active?\n>\n> In the **Web interface** section, in the **Web server certificate** row. Without a custom certificate, it says **not uploaded** and **internal certificate is used**; otherwise it shows the information about the uploaded certificate.\n\n> [!NOTE]\n> The file is not accepted\n>\n> The Behnke Station requires exactly one PEM file with exactly one certificate and an unencrypted private key. Common causes are a key file encrypted with a passphrase, a file with a complete certificate chain, or separate files for the certificate and the key.\n\n> [!NOTE]\n> Are video streams also transmitted via HTTPS?\n>\n> No. The **Access to the web interface** option does not affect the retrieval of images or video streams. These can still be retrieved via HTTP, even if HTTPS must be used for the web interface.\n\n> [!NOTE]\n> Does the certificate also apply to other functions of the Behnke Station?\n>\n> No. The web server certificate applies exclusively to access to the web interface. Certificates for other functions are configured separately, for example under %BS_MENU_SIP_TELEFON% for SIP or under %BS_MENU_NETZWERK% for port authentication, see [Port Authentication 802.1x via EAP-TLS](Portauthentifizierung_EAP-TLS).\n","lastModified":"2026-10-14T13:47:15+02:00"}