# How does the https gui options works?
**URL:** https://forum.syncthing.net/t/how-does-the-https-gui-options-works/11372
**Category:** Feature
**Created:** [March 12, 2018, 11:15am UTC](https://forum.syncthing.net/t/how-does-the-https-gui-options-works/11372 "2018-03-12T11:15:28Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@vcmota](https://forum.syncthing.net/u/vcmota)
#### Post date: [March 12, 2018, 11:15am UTC](https://forum.syncthing.net/t/how-does-the-https-gui-options-works/11372/1 "2018-03-12T11:15:28Z")
Yesterday I decided to check the box on the webgui interface asking for the browser to use https “Using HTTPS for GUI”. However, just after reloading the browser immediately warns that the connection is not secure, and from that on shows permanently in the address bar https in red with the no secure warn. So, my questions are: 1) Is this the normal behavior, and there is some configuration (perhaps in the browser itself and not in the webgui) that is not set up properly? 2) if not, is this a glitch of some sort within the GUI? 3) regardless, is both my data being transferred through sync and and any type of information stored in the client protected via cryptography? Thank you all for your attention.
---
### Author:  [@canton7](https://forum.syncthing.net/u/canton7)
#### Post date: [March 12, 2018, 11:45am UTC](https://forum.syncthing.net/t/how-does-the-https-gui-options-works/11372/2 "2018-03-12T11:45:53Z")
> Is this the normal behavior, and there is some configuration (perhaps in the browser itself and not in the webgui) that is not set up properly?
Yes it’s normal.
When a website (e.g. [syncthing.net](http://syncthing.net)) uses https, it gets a trusted authority to verify that the person asking for the https certificate actually controls the website address. This is included in the certificate given to the web browser. So when your browser connects to [syncthing.net](http://syncthing.net), it sees that this trusted authority has verified that the person who was given the https certificate actually controls [syncthing.net](http://syncthing.net): it can be sure that some malicious party isn’t intercepting your request and pretending to be [syncthing.net](http://syncthing.net)
It’s not possible to do this when connecting to a website using its IP address, particularly when that IP address is your local machine. The trusted authority is never going to issue a certificate saying that Syncthing has control over “127.0.0.1”.
What you can do is to tell your browser to trust the certificate generated by Syncthing (without relying on a trusted authority). How to do this depends on the browser, but you’ll find the certificate called `https-cert.pem` in Syncthing’s configuration directory.
> regardless, is both my data being transferred through sync and and any type of information stored in the client protected via cryptography? Thank you all for your attention.
Yes.
---
### Author:  [@darkmann](https://forum.syncthing.net/u/darkmann)
#### Post date: [August 20, 2023, 8:40am UTC](https://forum.syncthing.net/t/how-does-the-https-gui-options-works/11372/3 "2023-08-20T08:40:07Z")
What happens when https-cert.pem doesn’t exist?
---
### Author:  [@Nummer378](https://forum.syncthing.net/u/Nummer378)
#### Post date: [August 20, 2023, 12:26pm UTC](https://forum.syncthing.net/t/how-does-the-https-gui-options-works/11372/4 "2023-08-20T12:26:47Z")
IIRC it is (re-)generated automatically.