# HTTPS certificates

The HTTPS certificate is what lets browsers trust your Blink console's address. You manage certificates on **Instance** › **Certificates**. You need the **Certificates** instance permission.

## On Blink Cloud

Blink Cloud sets your Blink address and issues and renews its certificates for you. The **Certificates** page shows them as **Managed by Blink Cloud**, and there is nothing to configure.

## On your own server

The **Certificates** page offers three sources:

- **Let's Encrypt**: free certificates, issued and renewed automatically for the domains you list. The domains must point to your server.
- **Uploaded certificates**: a certificate from your own provider or private certificate authority. An uploaded certificate wins over Let's Encrypt for the names it covers.
- **Built-in certificate**: served to IP addresses and every name not covered above. Browsers don't trust it, so give your console address a real certificate.

The **Served names** card shows which certificate each host name gets right now.

If you use Blink View, customers' phones open your Blink address too, so give it a Let's Encrypt certificate or upload one from a public certificate authority; otherwise phones show a certificate warning. See [Fix Blink View problems](/troubleshooting/blink-view/#the-phone-shows-a-certificate-warning).

For step-by-step setup, see [Install](/install/).

## Certificates and agents

Agents don't depend on the console's certificate. They check your server's identity in a separate way, so changing, renewing or replacing a certificate never disconnects agents.

:::note
Uploading a certificate and key for your console's address is a powerful permission: whoever holds it could impersonate your sign-in page. That is why **Certificates** is a separate permission from **Instance settings**.
:::