# Guide for accessing webUI via HTTPS

**URL:** https://forum.syncthing.net/t/guide-for-accessing-webui-via-https/13013
**Category:** Support
**Created:** [March 14, 2019, 4:00am UTC](https://forum.syncthing.net/t/guide-for-accessing-webui-via-https/13013 "2019-03-14T04:00:30Z")
**Posts on this page:** 1
**Showing post:** 7

<div class="post-metadata">

### Author: ![Nummer378](https://forum.syncthing.net/user_avatar/forum.syncthing.net/nummer378/32/5958_2.png) [@Nummer378](https://forum.syncthing.net/u/Nummer378)
#### Post date: [March 14, 2019, 7:06pm UTC](https://forum.syncthing.net/t/guide-for-accessing-webui-via-https/13013/7 "2019-03-14T19:06:30Z")

</div>

Okay, I will try to give some short tutorials on a few of your questions:

```
Approach 1: Using a cronjob to manually copy the certificate

```

1. Make sure syncthing has the `https-key.pem` and `https-cert.pem` files present in it’s home directory; my commands assume the directory is `/home/syncthing/.config/syncthing` [that’s my setup). Make sure the permissions are correct, meaning the files are owned by the user running syncthing. The easiest way to achieve this is by deleting the current files while syncthing is stopped.
2. Upon the next start, syncthing will re-generate the `https-key.pem` and `https-cert.pem` files with the correct permissions (files are owned by user running syncthing). Now, you only need to overwrite the files - overwriting existing files does **not** change their permissions.
3. Open a shell/terminal on the machine, preferably as root or any other user that definetly has access to all certificates inside of `/etc/letsencrypt`. You can get root either by typing in `su` or by prefixing the following command with `sudo`.
4. Type `crontab -e` to edit the crontab of the current user
5. The file will be opened with some text editor, like nano. In the file, below the comments you can add the following lines:

> @daily cp /etc/letsencrypt/live/[domain]/privkey.pem /home/syncthing/.config/syncthing/https-key.pem

> @daily cp /etc/letsencrypt/live/[domain]/fullchain.pem /home/syncthing/.config/syncthing/https-cert.pem

1. This would copy the certificates from the let’s encrypt directory daily to the syncthing directory, overwriting existing files but without modifying file permissions. The solution is simple, but definetly not the best. The `@daily` should be supported by pretty much every standard cron and tells the system to run the command every day, I believe it’s at midnight.

> Approach 2: Syncthing behind nginx reverse proxy

1. It’s actually fairly straightforward, assuming that you already got nginx up and running. To prevent this guide from blowing up the forum, I will assume you already got that.
2. Every proper nginx-tutorial should tell you to create your configuration in a seperate file which should live inside `/etc/nginx/sites-available`. I will assume that you already have such a file and that it is called `reverse-proxy.conf`
3. To setup a reverse proxy, open the file `reverse-proxy.conf` and make it look like [this generic example](https://pastebin.com/LnWfVPSn). The file should include your old configuration (if any) and the new one.

> [@cloud\_sync](#):
>
> Parts 1 and 2 make sense to me. I don’t feel confident about my interpretation of part 3. What hook are you referring to? I am not a certbot expert.

I believe what’s meant is that certbot supports additional actions (called hooks) that are executed whenever certbot performs certain actions, such as renewing a certificate. You could create a hook that automatically restarts syncthing whenever certbot renews your certificate. A good piece of documentation to start with is here: [User Guide — Certbot 2.11.0.dev0 documentation](https://certbot.eff.org/docs/using.html#renewing-certificates)

---

_[View the full topic](https://forum.syncthing.net/t/guide-for-accessing-webui-via-https/13013)._