Use HTTPS whenever the Web UI is accessed beyond the host itself. AASM can generate a self-signed root CA and server certificate; automatic root installation is Windows-specific, while Linux requires a manual trust-store step or trusted reverse proxy.
Prerequisites:
- Web UI already enabled and working over HTTP.
- AASM admin role.
- Windows automatic trust requires PowerShell elevation; Linux trust-store changes require sudo/root access.
Step 1 - Open Maintenance → Maintenance & Management
Server tab (any server) → Maintenance sub-tab → Maintenance & Management. Scroll to the Quick Actions & Management card → SYSTEM OPERATIONS section.
Step 2 - Click Install Certificates
The cyan Install Certificates button (next to Open Firewall Ports) generates the certificate chain. On Windows, approve the elevation prompt so AASM can install the root certificate. On Linux, generate the files and then complete the trust-store step manually.
AASM creates a self-signed root CA and a server certificate for names such as localhost, the LAN IP and the host name. The certificate files are stored with AASM data; the Linux data root is ~/.local/share/aasm.
Step 3 - Configure Web UI to use HTTPS
Open the App Settings dialog → Web UI section. If a Use HTTPS toggle appears (it should now that the cert exists), enable it. The Web UI restarts and now listens on the same port over TLS.
Step 4 - Reconnect with https://
Update the URL you use to reach the Web UI:
https://192.168.1.42:3000
First visit, the browser will show a "Not secure" warning because the root CA isn't trusted yet. Step 5 fixes that.
Step 5 - Install the root CA into your trust store
Every client device must trust the generated root CA:
- Copy the root CA from the AASM host. On Ubuntu/Debian, place it at
/usr/local/share/ca-certificates/aasm.crtand runsudo update-ca-certificates. - Windows: double-click the .crt → Install Certificate → Local Machine → Trusted Root Certification Authorities.
- macOS: open Keychain Access, add it to the System keychain, then set it to Always Trust.
- Android/iOS: install it through the device certificate/security settings.
For internet exposure, prefer a publicly trusted certificate and restrict network access. Never expose the Web UI with default credentials.
Installing HTTPS Certificates for the Web UI - done
The Web UI is now served over HTTPS with a self-signed cert. Trust the root on every device you connect from to silence the browser warning.