# Fix a browser certificate warning

## Symptoms

Your browser, or your customer's, shows a warning such as "Your connection is not private" or "Warning: Potential Security Risk Ahead" when opening the Blink console or join page.

## Why it happens

Every Blink server has a **built-in certificate**. Browsers do not trust it, because no public certificate authority issued it. Blink serves it:

- when you open Blink by its **IP address** instead of a host name, and
- for any host name that has no trusted certificate yet.

If your license includes Blink View, a customer's phone can show the same warning, because the page the phone opens is served from your Blink address. The Blink View panel in the viewer warns you when your certificate is not publicly trusted. See [Fix Blink View problems](/troubleshooting/blink-view/#the-phone-shows-a-certificate-warning).

Once a host name has a trusted certificate from Let's Encrypt or one you uploaded, browsers stop warning for that name.

:::note
Certificates only affect browsers. Blink agents (the support tool and Access devices) check your server's own identity instead, and never use these certificates. Changing a certificate cannot break agent connections.
:::

## If you use Blink Cloud

Blink Cloud issues and renews the certificates for your Blink address for you. **Instance** › **Certificates** shows **Host names and certificates** with the names it manages. Make sure you open the address exactly as IZT gave it to you, for example `https://yourname.onblink.cloud`. If the warning appears on that address, contact IZT.

## If you run your own Blink server

You need the **Certificates** permission on the instance to do this.

### Find out which certificate a name gets

1. Open **Instance** › **Certificates**.
2. **Served names** lists each host name and the certificate it gets right now: **Let's Encrypt**, **Uploaded** or **Built-in**. If it says **All names use the built-in certificate.**, no trusted certificate is set up yet.
3. Check the note next to a name: for example **Let's Encrypt pending**, **Retrying at …**, or that a certificate has expired.

### Get a free certificate from Let's Encrypt

Before you start:

- Your host name must be a real DNS name (no IP address, no wildcard) that resolves to your Blink server.
- Let's Encrypt must reach your server on **TCP port 443** from the internet. If your server listens on another port, forward TCP 443 to it. The page warns you when this is needed.

Then:

1. In **Instance** › **Certificates**, under **Let's Encrypt**, tick **Use Let's Encrypt**.
2. Enter your host names under **Domains**, one per line.
3. Optionally enter an **Email**.
4. Under **Directory**, choose **Production**. **Staging** is for testing only: its certificates are not trusted by browsers either.
5. Click **Save**. Blink requests the certificate and renews it automatically. To ask again straight away, click **Issue now** next to the domain.

Each domain gets at most 4 attempts per hour. If a request fails, fix the cause (usually DNS or port 443) and wait for the retry time shown.

### Or upload your own certificate

1. In **Instance** › **Certificates**, under **Uploaded certificates**, click **Upload certificate**.
2. Paste or choose the **Certificate chain**: the server certificate first, then its intermediates.
3. Paste or choose the **Private key**, unencrypted. Use an RSA key of 2048 bits or more, or an ECDSA P-256 or P-384 key.
4. Click **Upload**. The certificate must name at least one DNS host name. A certificate from your own company CA is accepted, and shows as **Private CA**: only computers that trust that CA stop warning.

### Locked out after a certificate change

If a certificate change stops you from opening the console, the **Built-in certificate** card lists addresses that always work. Open one of them, accept the browser warning once, and fix the certificate settings. To be sure you reached your own server, compare the SHA-256 fingerprint your browser shows with the **Fingerprint** on that card, which you can note down in advance.

## Should I click through the warning?

Only when you know why it appears and have checked the fingerprint, for example during first setup by IP address. Never tell customers to click through a warning on the join page: set up a trusted certificate instead.

Passkeys also need a trusted connection: they only work when you open the console on its host name over HTTPS.

## When to contact IZT

Contact [IZT](https://izt.app) if Let's Encrypt keeps failing while DNS and port 443 are correct, or if you use Blink Cloud and see a warning on your Blink address. Send the host name and the message shown in **Served names**.