HTTPS and certificates
HTTPS is encrypted web access; a certificate is an electronic document proving a site is who it claims to be.
Think of it like this
A certificate is an ID card issued by a recognised authority. Only with a proper ID does the browser show the padlock.
In this setup
The server uses a free, browser-trusted IP certificate from Let's Encrypt (it names the IP rather than a domain), so you do not need to buy a domain. These certificates last only about 6 days; the server checks every 6 hours and renews automatically. The subscription, panel and AI API all use it.
Common misconceptions
- "A self-signed certificate is just as good": browsers and many apps reject self-signed certificates; this setup never uses them.
- "A padlock means the site is good": it only means the connection is encrypted and the identity is genuine — not that the content is trustworthy.
Related: IP address, Ports