Note: These steps refer to the Supervisor Web UI introduced in V13.0.0. If your device shows the earlier Web UI, without the Platform sidebar, this HTTPS setting is not available.

We recommend turning on HTTPS for the local Web UI so browsers connect to the device at a secure address. Sign-in and the settings you change then stay protected on your network. With Redirect visitors to HTTPS turned on, a browser that still opens the old address is sent to that secure connection.

Turn on HTTPS

Under Web access on the Supervisor tab, set HTTPS to the certificate that matches how you reach the device. For a Web UI used on your local network, we recommend Self-signed certificate.

Browse to the device's Web UI and sign in if prompted.
In the left sidebar, expand Platform and select Settings, then open the Supervisor tab.
Under Web access, set HTTPS to Self-signed certificate.
Leave HTTPS port at 8443 unless your network needs a different port. If Use standard web ports (80 / 443) is on, the device serves the secure Web UI on port 443 and the HTTPS port field is not shown.
Turn on Redirect visitors to HTTPS so browsers that open the old address are sent to the secure address.
Select Save. When the page confirms that the settings were applied, open the secure address in the next section.

Screenshot 1: Settings > Supervisor, Web access. The HTTPS menu lists Off, Self-signed certificate, Upload certificate, and Automatic certificate (Let's Encrypt).

Screenshot 2: HTTPS set to Self-signed certificate, with HTTPS port 8443 and Redirect visitors to HTTPS. The certificate panel still says HTTPS is off until you select Save.

Note: Secure Mode, in the Access section on the same tab, also turns HTTPS on. It is more extensive: it requires sign-in, uses the standard web ports, and restarts applications on the device. To secure the Web UI only, leave Secure Mode off and use the HTTPS setting under Web access.

Open the secure address

Open the Web UI at the secure address that matches the ports you saved:

Default ports. Browse to https://<device-ip>:8443. For example, a device at 192.168.1.50 is https://192.168.1.50:8443. If you changed HTTPS port, use the port you entered.

Standard web ports on. Browse to https://<device-ip>, with no port number. The same example is https://192.168.1.50.

The first time you open that address with a self-signed certificate, the browser asks you to continue because it does not recognize the certificate the device created. Continue to the Web UI. You may be asked again the next time you open the address.

For a connection the browser already trusts, use a certificate from your organization, or an automatic certificate when the device has a public domain name. Both are below.

After you save, the HTTPS certificate panel lists the certificate in use in place of HTTPS is off. If the page reports that the HTTPS certificate has expired or is about to expire, renew or replace it. If the panel reports an error instead, contact Videon Support and include a screenshot of the message if possible.

HTTPS does not turn on sign-in by itself. Sign-in is the Require sign-in setting on the same tab. See Setting up password protection.

Use a certificate from your organization

Choose Upload certificate when your organization can give you a certificate for the name or address you use to open the device. The browser can then open the Web UI without asking you to continue.

Under Web access, set HTTPS to Upload certificate.
Choose the Certificate file (.pem, .crt, or .cer) and the Private key file (.pem or .key). If your organization also provided a chain, choose it under Certificate chain (optional).
Select Upload. Then turn on Redirect visitors to HTTPS if it is not already on, and select Save. Leave HTTPS set to Upload certificate when you save.

The page tells you to upload the files, then save with HTTPS set to Upload certificate.

Use an automatic certificate

When the device has a public domain name, set HTTPS to Automatic certificate (Let's Encrypt). Enter a Certificate contact email and the Domain names, leave Use staging certificates (for testing) off, turn on Redirect visitors to HTTPS if it is not already on, and select Save.

The device must be able to reach Let's Encrypt, and the domain name must point to this device. After you save, check the HTTPS certificate panel. When the certificate is ready, it is listed there. If the panel reports an error, contact Videon Support and include a screenshot of the message if possible.

Frequently asked questions

What happens if the HTTPS certificate expires?

The HTTPS service continues running, but browsers that verify the certificate will reject new connections and show a certificate-expired warning. If Redirect visitors to HTTPS is on, the device continues sending HTTP visitors to the secure address, where the browser warning appears. The device's applications continue running. An HTTPS connection that was already open may continue temporarily, but it should not be relied on for access.

Renew or replace the certificate before its expiration date. After installing the replacement, confirm that a new browser session opens the Web UI without a certificate warning.

Who is responsible for the HTTPS certificate?

The customer is responsible for obtaining, installing, monitoring, and renewing certificates used with the device. Videon does not issue, manage, or renew customer-provided certificates.

For a self-signed certificate, the device creates the certificate, but the customer remains responsible for monitoring its expiration and deciding whether a self-signed certificate meets the organization's security requirements.

What about Automatic certificate (Let's Encrypt)?

When Automatic certificate (Let's Encrypt) is selected, the device attempts to obtain and renew the certificate automatically. The customer remains responsible for maintaining the domain name, DNS records, and required network access, and for monitoring the HTTPS certificate panel to confirm that issuance and renewal succeed.

How do I restore access after a certificate expires?

Connect from the trusted local network. If the browser provides an option to continue after reviewing the certificate warning, continue to the Web UI.
Go to Platform > Settings > Supervisor and replace the certificate under Web access. For an organization-provided certificate, select Upload certificate, upload the new certificate and private key, and select Save.
Open a new browser session at the secure address and confirm that the warning no longer appears.

If the browser does not provide a way to continue, or if the device reports an upload or Web UI error, contact Videon Support and include a screenshot of the message if possible. Videon Support can help troubleshoot the device or Web UI, but certificate issuance and renewal remain the customer's responsibility.

Articles in this section

Enable HTTPS for the Local Web UI