> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lstack.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Custom TLS certificate

> Encrypt LAN access with a certificate and private key that you provide.

Custom TLS encrypts traffic between LStack and other devices on your network. LStack uses the certificate files you provide and does not create or manage a certificate authority for you.

## What you need

Prepare:

* A certificate in PEM format
* The matching private key in PEM format
* An optional certificate-authority bundle
* A certificate whose Subject Alternative Name covers the LAN address selected in LStack

Every device that opens LStack must trust the certificate issuer. A private or self-signed certificate may show a browser warning until its certificate authority is installed and trusted on that device.

<Warning>
  Do not continue through an unexpected certificate warning. Confirm that the address, certificate, and issuer are the ones you configured.
</Warning>

## Add the certificate

<Steps>
  <Step title="Open LAN settings">
    On the computer running LStack, open **Settings → LAN access**.
  </Step>

  <Step title="Open Advanced">
    Expand **Advanced — encrypted connection with your own certificate**.
  </Step>

  <Step title="Choose the encrypted connection">
    Set **Connection type** to **Custom certificate — encrypted**.
  </Step>

  <Step title="Select your files">
    Enter the full paths to the certificate and matching private key. Add the certificate-authority bundle if your certificate requires one.
  </Step>

  <Step title="Check and apply">
    LStack checks that the files can be read, the certificate matches the key, the certificate is valid, and its Subject Alternative Name covers the selected address. Apply the settings after the checks pass.
  </Step>
</Steps>

The resulting address uses HTTPS:

```text theme={null}
https://192.168.1.50:8443
```

You can use any available port from `1024` through `65535`.

## Replace an expiring certificate

Replace the certificate and key files, return to **Settings → LAN access**, and apply the settings again. An invalid or expired certificate is refused and never causes LStack to fall back to an unencrypted connection.