# SSL certificate setup
**URL:** https://forum.syncthing.net/t/ssl-certificate-setup/2901
**Category:** Support
**Created:** [May 30, 2015, 7:24pm UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901 "2015-05-30T19:24:40Z")
**Posts on this page:** 18
**Page:** 1
### Author:  [@kzs](https://forum.syncthing.net/u/kzs)
#### Post date: [May 30, 2015, 7:24pm UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901/1 "2015-05-30T19:24:40Z")
Hi all,
I have a VPS with digitalocean, running Ubuntu 14.04. I have just set up syncthing on it… however I’ve already been using it for another service (owncloud) before, where an external SSL certificate (startssl) has been successfully set up and is being used.
My problem is: now I can’t access my server. Error message: “This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox only connect to it securely. As a result, it is not possible to add an exception for this certificate.”
I’m pretty sure this only shows that my server is OK, and the SSL is just doing it’s job, and blocking the self-signed certificate generated by the syncthing setup. Not sure if it’s relevant: syncthing is running on the server as it’s own user, other services under apache, normally.
Question: what config changes do I need to make so that syncthing uses the external certificate (not it’s self-signed one)?
Thanks in advance. kzs
---
### Author:  [@wweich](https://forum.syncthing.net/u/wweich)
#### Post date: [May 30, 2015, 8:51pm UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901/2 "2015-05-30T20:51:48Z")
inside the config directory (usually `~/.config/syncthing`) you have the `https-cert.pem` and `https-key.pem` which you can probably replace with your existing cert and key.
The `cert.pem` and `key.pem` are the ones used for the sync protocol and should not be replaced.
---
### Author:  [@kzs](https://forum.syncthing.net/u/kzs)
#### Post date: [May 30, 2015, 10:21pm UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901/3 "2015-05-30T22:21:59Z")
Perfect, working now. Thanks a lot
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [June 1, 2015, 11:40am UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901/4 "2015-06-01T11:40:20Z")
This should probably be added to the FAQ…
---
### Author:  [@gsola96](https://forum.syncthing.net/u/gsola96)
#### Post date: [February 18, 2016, 6:55pm UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901/5 "2016-02-18T18:55:39Z")
Hey you all and sorry to get this thread alive after that time. It’s my first intervention in this forum so I think it’s worth it to thank people who are involved in having Syncthing running. I installed it some time ago and I could not be more satisfied.
So here is my question: I have Syncthing running on my OpenMediaVault Server at home. I have a free Let’s Encrypt certificate to secure my HTTPS connections to my server (running also an OpenVPN Access Server and an FTPS among other things). Looking for advice on how to change the default SSL certificates to connect to the WebGUI on my server, I found this thread. As @wweich suggests, I changed https-cert.pem and https-key.pem on my Syncthing config directory but it seems like the Server does not use them since when I connect via HTTPS, I get an HSTS warning from Firefox because the issuer if the SSL cert is not trusted (because it’s using a self-signed one, not the Let’s Encrypt one, which is trusted).
Do you have any clue on how to get it working with custom SSL certs?
Thanks in advance. Guillem
---
### Author:  [@AudriusButkevicius](https://forum.syncthing.net/u/AudriusButkevicius)
#### Post date: [February 18, 2016, 7:48pm UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901/6 "2016-02-18T19:48:58Z")
Did you restart syncthing? Also, are you sure you’ve put the certs in the right location?
---
### Author:  [@gsola96](https://forum.syncthing.net/u/gsola96)
#### Post date: [February 18, 2016, 8:10pm UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901/7 "2016-02-18T20:10:50Z")
Thanks for the fast response! Yep, restarted Syncthing, rebooted server… Location of my certs is /bin/.config/syncthing since it is installed as an Open Media Vault plugin. But I’m sure it is right because there is not anywhere where the files https-key.pem and https-cert.pem exist. In this directory are also the cert.pem and key.pem (suposing they are used to encrypt transfers). What is strange is that I changed the certs and Syncthing is still using the old ones, but, how can it work with them if they have changed? Any other idea?
Thanks for your time. Guillem
---
### Author:  [@AudriusButkevicius](https://forum.syncthing.net/u/AudriusButkevicius)
#### Post date: [February 18, 2016, 9:00pm UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901/8 "2016-02-18T21:00:03Z")
Verify that the files are the same as you copied them in, perhaps syncthing simply regenerated them at some point?
---
### Author:  [@gsola96](https://forum.syncthing.net/u/gsola96)
#### Post date: [February 20, 2016, 11:46am UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901/9 "2016-02-20T11:46:44Z")
No. The files are the ones I put at some time… I will ask on OpenMediaVault forums; maybe they have changed something when implementing the plugin…
---
### Author:  [@ingo.d](https://forum.syncthing.net/u/ingo.d)
#### Post date: [December 1, 2016, 7:54am UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901/10 "2016-12-01T07:54:19Z")
Any idea where the certificate files are stored in the Windows version?
---
### Author:  [@canton7](https://forum.syncthing.net/u/canton7)
#### Post date: [December 1, 2016, 9:38am UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901/11 "2016-12-01T09:38:09Z")
See [https://docs.syncthing.net/users/config.html](https://docs.syncthing.net/users/config.html)
---
### Author:  [@rumpelsepp](https://forum.syncthing.net/u/rumpelsepp)
#### Post date: [December 1, 2016, 10:17am UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901/12 "2016-12-01T10:17:53Z")
```
$ syncthing -paths
Configuration file:
/home/stefan/.config/syncthing/config.xml
Database directory:
/home/stefan/.config/syncthing/index-v0.14.0.db
Device private key & certificate files:
/home/stefan/.config/syncthing/key.pem
/home/stefan/.config/syncthing/cert.pem
HTTPS private key & certificate files:
/home/stefan/.config/syncthing/https-key.pem
/home/stefan/.config/syncthing/https-cert.pem
Log file:
/home/stefan/.config/syncthing/syncthing.log
GUI override directory:
/home/stefan/.config/syncthing/gui
Default sync folder directory:
/home/stefan/Sync
```
---
### Author:  [@canton7](https://forum.syncthing.net/u/canton7)
#### Post date: [December 1, 2016, 10:24am UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901/13 "2016-12-01T10:24:38Z")
He asked for the Windows version.
---
### Author:  [@rumpelsepp](https://forum.syncthing.net/u/rumpelsepp)
#### Post date: [December 1, 2016, 10:26am UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901/14 "2016-12-01T10:26:37Z")
He can issue this command `syncthing -paths` on his machine.
---
### Author:  [@ingo.d](https://forum.syncthing.net/u/ingo.d)
#### Post date: [December 1, 2016, 11:57am UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901/15 "2016-12-01T11:57:04Z")
Thanks. So the answer is, as always, in the fine manual… 🙂
---
### Author:  [@dirad](https://forum.syncthing.net/u/dirad)
#### Post date: [December 25, 2016, 5:33pm UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901/16 "2016-12-25T17:33:09Z")
In case of working with a server behind my home NAT, does it make sense to leave the https certificates as is, or should i create self-signed ones for it?
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [December 25, 2016, 7:54pm UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901/17 "2016-12-25T19:54:14Z")
If you don’t know that you have a particular reason to replace them it’s much simpler to let them be.
---
### Author:  [@system](https://forum.syncthing.net/u/system)
#### Post date: [May 12, 2017, 1:08pm UTC](https://forum.syncthing.net/t/ssl-certificate-setup/2901/18 "2017-05-12T13:08:50Z")