If you only access the Web UI from the host PC, plain HTTP is fine. The moment you access it over LAN (let alone WAN), you want HTTPS so passwords and session cookies aren't in the clear. AASM v0.8.3 ships a one-click Install Certificates button that generates a self-signed root CA + a server cert for the Web UI - and optionally installs the root into Windows' trusted store so your browser stops warning.

Prerequisites:

Web UI already enabled and working over HTTP.
AASM admin role.
You'll be running PowerShell with elevation (Windows UAC prompt).

Step 1 - Open Maintenance → Maintenance & Management

Server tab (any server) → Maintenance sub-tab → Maintenance & Management. Scroll to the Quick Actions & Management card → SYSTEM OPERATIONS section.

Step 2 - Click Install Certificates

The cyan Install Certificates button (next to Open Firewall Ports) generates the cert chain. Windows will prompt for elevation - approve it.

AASM creates a self-signed root CA + a server certificate bound to the host PC's common names (e.g. localhost, the LAN IP, the machine's hostname). The certs are stored next to AASM's data directory.

Step 3 - Configure Web UI to use HTTPS

Open the App Settings dialog → Web UI section. If a Use HTTPS toggle appears (it should now that the cert exists), enable it. The Web UI restarts and now listens on the same port over TLS.

Step 4 - Reconnect with https://

Update the URL you use to reach the Web UI:

https://192.168.1.42:3000

First visit, the browser will show a "Not secure" warning because the root CA isn't trusted yet. Step 5 fixes that.

Step 5 - Install the root CA into your trust store

On the AASM host PC, the root CA was already installed during step 2 (Windows trusted-root store). On other devices (your laptop, phone, etc.) you need to install it manually:

Copy the root CA file from the AASM host (location shown in Maintenance after install) to the device.
Windows other PC: double-click the .crt → Install Certificate → Local Machine → Trusted Root Certification Authorities.
macOS: double-click → Keychain Access → drag into System keychain → set to Always Trust.
Android/iOS: email yourself the .crt and install via the device's Settings → Security → CA install flow.

Self-signed certs are fine for LAN. For real WAN exposure, get a Let's Encrypt cert via your domain name and point AASM at it (advanced; see the Discord for help).