From b1aff1f481fe92814cc16120efefd44f56759fb7 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Mon, 30 Mar 2026 10:57:49 +0200
Subject: [PATCH 01/29] bootstrap settings certs tab

---
 web/messages/en/settings.json                 |  5 +++
 .../SettingsIndexPage/SettingsIndexPage.tsx   |  4 ++
 .../SettingsCertificatesTab.tsx               | 28 ++++++++++++
 .../pages/settings/SettingsIndexPage/types.ts |  1 +
 web/src/routeTree.gen.ts                      | 44 +++++++++++++++++++
 .../_authorized/_default/settings/ca.tsx      |  9 ++++
 .../_authorized/_default/settings/certs.tsx   |  9 ++++
 7 files changed, 100 insertions(+)
 create mode 100644 web/src/pages/settings/SettingsIndexPage/tabs/SettingsCertificatesTab/SettingsCertificatesTab.tsx
 create mode 100644 web/src/routes/_authorized/_default/settings/ca.tsx
 create mode 100644 web/src/routes/_authorized/_default/settings/certs.tsx

diff --git a/web/messages/en/settings.json b/web/messages/en/settings.json
index e8fc854f6b..2ac4bb6e22 100644
--- a/web/messages/en/settings.json
+++ b/web/messages/en/settings.json
@@ -27,6 +27,10 @@
   "settings_instance_helper_session_duration": "",
   "settings_instance_label_password_reset_session_expiration": "Password reset session expiration",
   "settings_instance_helper_password_reset_session_expiration": "",
+  "settings_certs_ca_title": "Defguard Certificate Authority",
+  "settings_certs_ca_description": "Manage certificates automatically generated by Defguard for secure communication. These certificates are used to authenticate devices and services, ensuring encrypted connections across your network.",
+  "settings_certs_certs_title": "Edge/Core Certificates",
+  "settings_certs_certs_description": "Add and manage certificates issued outside of Defguard. Use them to integrate existing infrastructure and maintain secure connections with external systems and services.",
   "settings_vpn_stats_toggle_title": "Stats purge",
   "settings_vpn_stats_label_purge_frequency": "Stats purge frequency",
   "settings_vpn_stats_helper_purge_frequency": "",
@@ -87,6 +91,7 @@
   "settings_tab_general": "General",
   "settings_tab_notifications": "Notifications",
   "settings_tab_identity_providers": "External identity providers",
+  "settings_tab_certificates": "Certificates",
   "settings_tab_activity_streaming": "Activity streaming",
   "settings_tab_license": "License",
   "settings_general_section_instance_content": "Configure your instance name and branding settings. Add a logo to personalize the interface and make it easily recognizable to your users.",
diff --git a/web/src/pages/settings/SettingsIndexPage/SettingsIndexPage.tsx b/web/src/pages/settings/SettingsIndexPage/SettingsIndexPage.tsx
index b473fcc27f..109d3fb2df 100644
--- a/web/src/pages/settings/SettingsIndexPage/SettingsIndexPage.tsx
+++ b/web/src/pages/settings/SettingsIndexPage/SettingsIndexPage.tsx
@@ -12,6 +12,7 @@ import { SettingsGeneralTab } from './tabs/SettingsGeneralTab';
 import { SettingsLicenseTab } from './tabs/SettingsLicenseTab/SettingsLicenseTab';
 import { SettingsNotificationsTab } from './tabs/SettingsNotificationsTab';
 import { type SettingsTabValue, settingsTabsSchema } from './types';
+import { SettingsCertificatesTab } from './tabs/SettingsCertificatesTab/SettingsCertificatesTab';
 
 const tabComponent: Record<SettingsTabValue, JSX.Element> = {
   general: <SettingsGeneralTab />,
@@ -19,6 +20,7 @@ const tabComponent: Record<SettingsTabValue, JSX.Element> = {
   activity: <SettingsActivityLogStreamingPage />,
   license: <SettingsLicenseTab />,
   identity: <SettingsExternalProvidersTab />,
+  certs: <SettingsCertificatesTab />,
 };
 
 const tabToTitle = (tab: SettingsTabValue): string => {
@@ -33,6 +35,8 @@ const tabToTitle = (tab: SettingsTabValue): string => {
       return m.settings_tab_notifications();
     case 'identity':
       return m.settings_tab_identity_providers();
+    case 'certs':
+      return m.settings_tab_certificates();
   }
 };
 
diff --git a/web/src/pages/settings/SettingsIndexPage/tabs/SettingsCertificatesTab/SettingsCertificatesTab.tsx b/web/src/pages/settings/SettingsIndexPage/tabs/SettingsCertificatesTab/SettingsCertificatesTab.tsx
new file mode 100644
index 0000000000..74828cc093
--- /dev/null
+++ b/web/src/pages/settings/SettingsIndexPage/tabs/SettingsCertificatesTab/SettingsCertificatesTab.tsx
@@ -0,0 +1,28 @@
+import { Link } from "@tanstack/react-router";
+import { SettingsLayout } from "../../../../../shared/components/SettingsLayout/SettingsLayout";
+import { SectionSelect } from "../../../../../shared/defguard-ui/components/SectionSelect/SectionSelect";
+import { m } from '../../../../../paraglide/messages';
+import { SizedBox } from "../../../../../shared/defguard-ui/components/SizedBox/SizedBox";
+import { ThemeSpacing } from "../../../../../shared/defguard-ui/types";
+
+export const SettingsCertificatesTab = () => {
+  return (
+    <SettingsLayout id="certificates-settings">
+      <Link to="/settings/ca">
+        <SectionSelect
+          image="customization"
+          title={m.settings_certs_ca_title()}
+          content={m.settings_certs_ca_description()}
+        />
+      </Link>
+      <SizedBox height={ThemeSpacing.Xl} />
+      <Link to="/settings/certs">
+        <SectionSelect
+          image="customization"
+          title={m.settings_certs_certs_title()}
+          content={m.settings_certs_certs_description()}
+        />
+      </Link>
+    </SettingsLayout>
+  );
+}
diff --git a/web/src/pages/settings/SettingsIndexPage/types.ts b/web/src/pages/settings/SettingsIndexPage/types.ts
index 55bb1747c6..f3888c6105 100644
--- a/web/src/pages/settings/SettingsIndexPage/types.ts
+++ b/web/src/pages/settings/SettingsIndexPage/types.ts
@@ -7,6 +7,7 @@ export const settingsTabsSchema = z.enum([
   'notifications',
   'identity',
   'activity',
+  'certs',
   'license',
 ]);
 
diff --git a/web/src/routeTree.gen.ts b/web/src/routeTree.gen.ts
index 65413be998..63a87d2c8b 100644
--- a/web/src/routeTree.gen.ts
+++ b/web/src/routeTree.gen.ts
@@ -56,6 +56,8 @@ import { Route as AuthorizedDefaultSettingsInstanceRouteImport } from './routes/
 import { Route as AuthorizedDefaultSettingsGatewayNotificationsRouteImport } from './routes/_authorized/_default/settings/gateway-notifications'
 import { Route as AuthorizedDefaultSettingsEditOpenidRouteImport } from './routes/_authorized/_default/settings/edit-openid'
 import { Route as AuthorizedDefaultSettingsClientRouteImport } from './routes/_authorized/_default/settings/client'
+import { Route as AuthorizedDefaultSettingsCertsRouteImport } from './routes/_authorized/_default/settings/certs'
+import { Route as AuthorizedDefaultSettingsCaRouteImport } from './routes/_authorized/_default/settings/ca'
 import { Route as AuthorizedDefaultAclRulesRouteImport } from './routes/_authorized/_default/acl/rules'
 import { Route as AuthorizedDefaultAclEditRuleRouteImport } from './routes/_authorized/_default/acl/edit-rule'
 import { Route as AuthorizedDefaultAclEditDestinationRouteImport } from './routes/_authorized/_default/acl/edit-destination'
@@ -323,6 +325,18 @@ const AuthorizedDefaultSettingsClientRoute =
     path: '/settings/client',
     getParentRoute: () => AuthorizedDefaultRoute,
   } as any)
+const AuthorizedDefaultSettingsCertsRoute =
+  AuthorizedDefaultSettingsCertsRouteImport.update({
+    id: '/settings/certs',
+    path: '/settings/certs',
+    getParentRoute: () => AuthorizedDefaultRoute,
+  } as any)
+const AuthorizedDefaultSettingsCaRoute =
+  AuthorizedDefaultSettingsCaRouteImport.update({
+    id: '/settings/ca',
+    path: '/settings/ca',
+    getParentRoute: () => AuthorizedDefaultRoute,
+  } as any)
 const AuthorizedDefaultAclRulesRoute =
   AuthorizedDefaultAclRulesRouteImport.update({
     id: '/acl/rules',
@@ -439,6 +453,8 @@ export interface FileRoutesByFullPath {
   '/acl/edit-destination': typeof AuthorizedDefaultAclEditDestinationRoute
   '/acl/edit-rule': typeof AuthorizedDefaultAclEditRuleRoute
   '/acl/rules': typeof AuthorizedDefaultAclRulesRoute
+  '/settings/ca': typeof AuthorizedDefaultSettingsCaRoute
+  '/settings/certs': typeof AuthorizedDefaultSettingsCertsRoute
   '/settings/client': typeof AuthorizedDefaultSettingsClientRoute
   '/settings/edit-openid': typeof AuthorizedDefaultSettingsEditOpenidRoute
   '/settings/gateway-notifications': typeof AuthorizedDefaultSettingsGatewayNotificationsRoute
@@ -497,6 +513,8 @@ export interface FileRoutesByTo {
   '/acl/edit-destination': typeof AuthorizedDefaultAclEditDestinationRoute
   '/acl/edit-rule': typeof AuthorizedDefaultAclEditRuleRoute
   '/acl/rules': typeof AuthorizedDefaultAclRulesRoute
+  '/settings/ca': typeof AuthorizedDefaultSettingsCaRoute
+  '/settings/certs': typeof AuthorizedDefaultSettingsCertsRoute
   '/settings/client': typeof AuthorizedDefaultSettingsClientRoute
   '/settings/edit-openid': typeof AuthorizedDefaultSettingsEditOpenidRoute
   '/settings/gateway-notifications': typeof AuthorizedDefaultSettingsGatewayNotificationsRoute
@@ -559,6 +577,8 @@ export interface FileRoutesById {
   '/_authorized/_default/acl/edit-destination': typeof AuthorizedDefaultAclEditDestinationRoute
   '/_authorized/_default/acl/edit-rule': typeof AuthorizedDefaultAclEditRuleRoute
   '/_authorized/_default/acl/rules': typeof AuthorizedDefaultAclRulesRoute
+  '/_authorized/_default/settings/ca': typeof AuthorizedDefaultSettingsCaRoute
+  '/_authorized/_default/settings/certs': typeof AuthorizedDefaultSettingsCertsRoute
   '/_authorized/_default/settings/client': typeof AuthorizedDefaultSettingsClientRoute
   '/_authorized/_default/settings/edit-openid': typeof AuthorizedDefaultSettingsEditOpenidRoute
   '/_authorized/_default/settings/gateway-notifications': typeof AuthorizedDefaultSettingsGatewayNotificationsRoute
@@ -620,6 +640,8 @@ export interface FileRouteTypes {
     | '/acl/edit-destination'
     | '/acl/edit-rule'
     | '/acl/rules'
+    | '/settings/ca'
+    | '/settings/certs'
     | '/settings/client'
     | '/settings/edit-openid'
     | '/settings/gateway-notifications'
@@ -678,6 +700,8 @@ export interface FileRouteTypes {
     | '/acl/edit-destination'
     | '/acl/edit-rule'
     | '/acl/rules'
+    | '/settings/ca'
+    | '/settings/certs'
     | '/settings/client'
     | '/settings/edit-openid'
     | '/settings/gateway-notifications'
@@ -739,6 +763,8 @@ export interface FileRouteTypes {
     | '/_authorized/_default/acl/edit-destination'
     | '/_authorized/_default/acl/edit-rule'
     | '/_authorized/_default/acl/rules'
+    | '/_authorized/_default/settings/ca'
+    | '/_authorized/_default/settings/certs'
     | '/_authorized/_default/settings/client'
     | '/_authorized/_default/settings/edit-openid'
     | '/_authorized/_default/settings/gateway-notifications'
@@ -1102,6 +1128,20 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AuthorizedDefaultSettingsClientRouteImport
       parentRoute: typeof AuthorizedDefaultRoute
     }
+    '/_authorized/_default/settings/certs': {
+      id: '/_authorized/_default/settings/certs'
+      path: '/settings/certs'
+      fullPath: '/settings/certs'
+      preLoaderRoute: typeof AuthorizedDefaultSettingsCertsRouteImport
+      parentRoute: typeof AuthorizedDefaultRoute
+    }
+    '/_authorized/_default/settings/ca': {
+      id: '/_authorized/_default/settings/ca'
+      path: '/settings/ca'
+      fullPath: '/settings/ca'
+      preLoaderRoute: typeof AuthorizedDefaultSettingsCaRouteImport
+      parentRoute: typeof AuthorizedDefaultRoute
+    }
     '/_authorized/_default/acl/rules': {
       id: '/_authorized/_default/acl/rules'
       path: '/acl/rules'
@@ -1208,6 +1248,8 @@ interface AuthorizedDefaultRouteChildren {
   AuthorizedDefaultAclEditDestinationRoute: typeof AuthorizedDefaultAclEditDestinationRoute
   AuthorizedDefaultAclEditRuleRoute: typeof AuthorizedDefaultAclEditRuleRoute
   AuthorizedDefaultAclRulesRoute: typeof AuthorizedDefaultAclRulesRoute
+  AuthorizedDefaultSettingsCaRoute: typeof AuthorizedDefaultSettingsCaRoute
+  AuthorizedDefaultSettingsCertsRoute: typeof AuthorizedDefaultSettingsCertsRoute
   AuthorizedDefaultSettingsClientRoute: typeof AuthorizedDefaultSettingsClientRoute
   AuthorizedDefaultSettingsEditOpenidRoute: typeof AuthorizedDefaultSettingsEditOpenidRoute
   AuthorizedDefaultSettingsGatewayNotificationsRoute: typeof AuthorizedDefaultSettingsGatewayNotificationsRoute
@@ -1246,6 +1288,8 @@ const AuthorizedDefaultRouteChildren: AuthorizedDefaultRouteChildren = {
     AuthorizedDefaultAclEditDestinationRoute,
   AuthorizedDefaultAclEditRuleRoute: AuthorizedDefaultAclEditRuleRoute,
   AuthorizedDefaultAclRulesRoute: AuthorizedDefaultAclRulesRoute,
+  AuthorizedDefaultSettingsCaRoute: AuthorizedDefaultSettingsCaRoute,
+  AuthorizedDefaultSettingsCertsRoute: AuthorizedDefaultSettingsCertsRoute,
   AuthorizedDefaultSettingsClientRoute: AuthorizedDefaultSettingsClientRoute,
   AuthorizedDefaultSettingsEditOpenidRoute:
     AuthorizedDefaultSettingsEditOpenidRoute,
diff --git a/web/src/routes/_authorized/_default/settings/ca.tsx b/web/src/routes/_authorized/_default/settings/ca.tsx
new file mode 100644
index 0000000000..87b4268d12
--- /dev/null
+++ b/web/src/routes/_authorized/_default/settings/ca.tsx
@@ -0,0 +1,9 @@
+import { createFileRoute } from '@tanstack/react-router'
+
+export const Route = createFileRoute('/_authorized/_default/settings/ca')({
+  component: RouteComponent,
+})
+
+function RouteComponent() {
+  return <div>Hello "/_authorized/_default/settings/ca"!</div>
+}
diff --git a/web/src/routes/_authorized/_default/settings/certs.tsx b/web/src/routes/_authorized/_default/settings/certs.tsx
new file mode 100644
index 0000000000..5ed8fa8ebe
--- /dev/null
+++ b/web/src/routes/_authorized/_default/settings/certs.tsx
@@ -0,0 +1,9 @@
+import { createFileRoute } from '@tanstack/react-router'
+
+export const Route = createFileRoute('/_authorized/_default/settings/certs')({
+  component: RouteComponent,
+})
+
+function RouteComponent() {
+  return <div>Hello "/_authorized/_default/settings/certs"!</div>
+}

From b82348568738006284fee04663b424c847b0e918 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Mon, 30 Mar 2026 11:22:47 +0200
Subject: [PATCH 02/29] bootstrap cert settings pages

---
 .../SettingsCaPage/SettingsCaPage.tsx         | 52 +++++++++++++++++++
 .../SettingsCertificatesPage.tsx              | 52 +++++++++++++++++++
 .../_authorized/_default/settings/ca.tsx      |  9 ++--
 .../_authorized/_default/settings/certs.tsx   |  9 ++--
 4 files changed, 110 insertions(+), 12 deletions(-)
 create mode 100644 web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
 create mode 100644 web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx

diff --git a/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx b/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
new file mode 100644
index 0000000000..7f6640880d
--- /dev/null
+++ b/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
@@ -0,0 +1,52 @@
+import { Link } from '@tanstack/react-router';
+import { m } from '../../../paraglide/messages';
+import type { Settings } from '../../../shared/api/types';
+import { Breadcrumbs } from '../../../shared/components/Breadcrumbs/Breadcrumbs';
+import { Page } from '../../../shared/components/Page/Page';
+import { SettingsCard } from '../../../shared/components/SettingsCard/SettingsCard';
+import { SettingsHeader } from '../../../shared/components/SettingsHeader/SettingsHeader';
+import { SettingsLayout } from '../../../shared/components/SettingsLayout/SettingsLayout';
+import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
+import { getSettingsQueryOptions } from '../../../shared/query';
+import { useQuery } from '@tanstack/react-query';
+
+const breadcrumbs = [
+  <Link
+    to="/settings"
+    search={{
+      tab: 'general',
+    }}
+    key={0}
+  >
+    {m.settings_breadcrumb_general()}
+  </Link>,
+  <Link to="/settings/ca" key={1}>
+    {m.settings_breadcrumb_instance()}
+  </Link>,
+];
+
+export const SettingsCaPage = () => {
+  const { data: settings } = useQuery(getSettingsQueryOptions);
+  return (
+    <Page title={m.settings_page_title()}>
+      <Breadcrumbs links={breadcrumbs} />
+      <SettingsLayout>
+        <SettingsHeader
+          icon="customize"
+          title={m.settings_certs_ca_title()}
+          subtitle={m.settings_certs_ca_description()}
+        />
+        {isPresent(settings) && (
+          <SettingsCard>
+            <Content settings={settings} />
+          </SettingsCard>
+        )}
+      </SettingsLayout>
+    </Page>
+  );
+};
+
+const Content = ({ settings }: { settings: Settings }) => {
+  console.log(settings);
+  return (<div>TODO</div>);
+};
diff --git a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
new file mode 100644
index 0000000000..90d00e323a
--- /dev/null
+++ b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
@@ -0,0 +1,52 @@
+import { Link } from '@tanstack/react-router';
+import { m } from '../../../paraglide/messages';
+import type { Settings } from '../../../shared/api/types';
+import { Breadcrumbs } from '../../../shared/components/Breadcrumbs/Breadcrumbs';
+import { Page } from '../../../shared/components/Page/Page';
+import { SettingsCard } from '../../../shared/components/SettingsCard/SettingsCard';
+import { SettingsHeader } from '../../../shared/components/SettingsHeader/SettingsHeader';
+import { SettingsLayout } from '../../../shared/components/SettingsLayout/SettingsLayout';
+import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
+import { getSettingsQueryOptions } from '../../../shared/query';
+import { useQuery } from '@tanstack/react-query';
+
+const breadcrumbs = [
+  <Link
+    to="/settings"
+    search={{
+      tab: 'general',
+    }}
+    key={0}
+  >
+    {m.settings_breadcrumb_general()}
+  </Link>,
+  <Link to="/settings/certs" key={1}>
+    {m.settings_breadcrumb_instance()}
+  </Link>,
+];
+
+export const SettingsCertificatesPage = () => {
+  const { data: settings } = useQuery(getSettingsQueryOptions);
+  return (
+    <Page title={m.settings_page_title()}>
+      <Breadcrumbs links={breadcrumbs} />
+      <SettingsLayout>
+        <SettingsHeader
+          icon="customize"
+          title={m.settings_certs_certs_title()}
+          subtitle={m.settings_certs_certs_description()}
+        />
+        {isPresent(settings) && (
+          <SettingsCard>
+            <Content settings={settings} />
+          </SettingsCard>
+        )}
+      </SettingsLayout>
+    </Page>
+  );
+};
+
+const Content = ({ settings }: { settings: Settings }) => {
+  console.log(settings);
+  return (<div>TODO</div>);
+};
diff --git a/web/src/routes/_authorized/_default/settings/ca.tsx b/web/src/routes/_authorized/_default/settings/ca.tsx
index 87b4268d12..6dec5b74ca 100644
--- a/web/src/routes/_authorized/_default/settings/ca.tsx
+++ b/web/src/routes/_authorized/_default/settings/ca.tsx
@@ -1,9 +1,6 @@
 import { createFileRoute } from '@tanstack/react-router'
+import { SettingsCaPage } from '../../../../pages/settings/SettingsCaPage/SettingsCaPage';
 
 export const Route = createFileRoute('/_authorized/_default/settings/ca')({
-  component: RouteComponent,
-})
-
-function RouteComponent() {
-  return <div>Hello "/_authorized/_default/settings/ca"!</div>
-}
+  component: SettingsCaPage,
+});
diff --git a/web/src/routes/_authorized/_default/settings/certs.tsx b/web/src/routes/_authorized/_default/settings/certs.tsx
index 5ed8fa8ebe..b8a0fd6112 100644
--- a/web/src/routes/_authorized/_default/settings/certs.tsx
+++ b/web/src/routes/_authorized/_default/settings/certs.tsx
@@ -1,9 +1,6 @@
 import { createFileRoute } from '@tanstack/react-router'
+import { SettingsCertificatesPage } from '../../../../pages/settings/SettingsCertificatesPage/SettingsCertificatesPage';
 
 export const Route = createFileRoute('/_authorized/_default/settings/certs')({
-  component: RouteComponent,
-})
-
-function RouteComponent() {
-  return <div>Hello "/_authorized/_default/settings/certs"!</div>
-}
+  component: SettingsCertificatesPage,
+});

From a3b212ad0eca40cbd12cfba496caa7546bedac87 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Mon, 30 Mar 2026 12:49:51 +0200
Subject: [PATCH 03/29] ca cert styling

---
 web/messages/en/settings.json                 |  5 ++
 .../SettingsCaPage/SettingsCaPage.tsx         | 48 ++++++++++++++-----
 .../pages/settings/SettingsCaPage/style.scss  | 20 ++++++++
 .../SettingsCertificatesPage.tsx              | 14 +++---
 4 files changed, 67 insertions(+), 20 deletions(-)
 create mode 100644 web/src/pages/settings/SettingsCaPage/style.scss

diff --git a/web/messages/en/settings.json b/web/messages/en/settings.json
index 2ac4bb6e22..3d59b05b93 100644
--- a/web/messages/en/settings.json
+++ b/web/messages/en/settings.json
@@ -29,6 +29,11 @@
   "settings_instance_helper_password_reset_session_expiration": "",
   "settings_certs_ca_title": "Defguard Certificate Authority",
   "settings_certs_ca_description": "Manage certificates automatically generated by Defguard for secure communication. These certificates are used to authenticate devices and services, ensuring encrypted connections across your network.",
+  "settings_certs_ca_summary_title": "Certificate authority summary",
+  "settings_certs_ca_summary": "The system created all required certificate files, including the root certificate and private key. You can download these files and continue with the configuration.",
+  "settings_certs_ca_certificate_validated_title": "Certificate Validated",
+  "settings_certs_ca_certificate_validated": "Your uploaded Certificate has been successfully validated. All required files were checked and confirmed as correct and ready for use. You can download the validated certificate files if needed for your setup.",
+  "settings_certs_ca_information_extracted": "Information extracted from uploaded files",
   "settings_certs_certs_title": "Edge/Core Certificates",
   "settings_certs_certs_description": "Add and manage certificates issued outside of Defguard. Use them to integrate existing infrastructure and maintain secure connections with external systems and services.",
   "settings_vpn_stats_toggle_title": "Stats purge",
diff --git a/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx b/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
index 7f6640880d..02c89be0f7 100644
--- a/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
+++ b/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
@@ -1,14 +1,18 @@
+import './style.scss';
 import { Link } from '@tanstack/react-router';
 import { m } from '../../../paraglide/messages';
-import type { Settings } from '../../../shared/api/types';
 import { Breadcrumbs } from '../../../shared/components/Breadcrumbs/Breadcrumbs';
 import { Page } from '../../../shared/components/Page/Page';
 import { SettingsCard } from '../../../shared/components/SettingsCard/SettingsCard';
 import { SettingsHeader } from '../../../shared/components/SettingsHeader/SettingsHeader';
 import { SettingsLayout } from '../../../shared/components/SettingsLayout/SettingsLayout';
-import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
-import { getSettingsQueryOptions } from '../../../shared/query';
-import { useQuery } from '@tanstack/react-query';
+import { DescriptionBlock } from '../../../shared/components/DescriptionBlock/DescriptionBlock';
+import { ActionableSection } from '../../../shared/defguard-ui/components/ActionableSection/ActionableSection';
+import { ActionableSectionVariant } from '../../../shared/defguard-ui/components/ActionableSection/types';
+import caIconSrc from '../../SetupPage/assets/ca.png';
+import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
+import { ThemeSpacing } from '../../../shared/defguard-ui/types';
+import { Divider } from '../../../shared/defguard-ui/components/Divider/Divider';
 
 const breadcrumbs = [
   <Link
@@ -26,7 +30,6 @@ const breadcrumbs = [
 ];
 
 export const SettingsCaPage = () => {
-  const { data: settings } = useQuery(getSettingsQueryOptions);
   return (
     <Page title={m.settings_page_title()}>
       <Breadcrumbs links={breadcrumbs} />
@@ -36,17 +39,36 @@ export const SettingsCaPage = () => {
           title={m.settings_certs_ca_title()}
           subtitle={m.settings_certs_ca_description()}
         />
-        {isPresent(settings) && (
-          <SettingsCard>
-            <Content settings={settings} />
-          </SettingsCard>
-        )}
+        <SettingsCard>
+          <DescriptionBlock title={m.settings_certs_ca_summary_title()}>
+            <p>{m.settings_certs_ca_summary()}</p>
+          </DescriptionBlock>
+          <SizedBox height={ThemeSpacing.Xl2} />
+          <Content />
+        </SettingsCard>
       </SettingsLayout>
     </Page>
   );
 };
 
-const Content = ({ settings }: { settings: Settings }) => {
-  console.log(settings);
-  return (<div>TODO</div>);
+const Content = () => {
+  return (
+    <ActionableSection
+      variant={ActionableSectionVariant.Secondary}
+      title={m.settings_certs_ca_certificate_validated_title()}
+      subtitle={m.settings_certs_ca_certificate_validated()}
+      imageSrc={caIconSrc}
+    >
+      <SizedBox height={ThemeSpacing.Xl3} />
+      <p className='ca-info-title'>{m.settings_certs_ca_information_extracted()}</p>
+      <Divider spacing={ThemeSpacing.Md}/>
+      <div className='ca-info-grid'>
+        <div className='ca-info-label'>Email</div>
+        <div className='ca-info-value'>test@mail.com</div>
+        <div className='ca-info-label'>Valid by</div>
+        <div className='ca-info-value'>25/03/2057  | 16:23:00</div>
+      </div>
+      <Divider spacing={ThemeSpacing.Md}/>
+    </ActionableSection>
+  );
 };
diff --git a/web/src/pages/settings/SettingsCaPage/style.scss b/web/src/pages/settings/SettingsCaPage/style.scss
new file mode 100644
index 0000000000..152830646a
--- /dev/null
+++ b/web/src/pages/settings/SettingsCaPage/style.scss
@@ -0,0 +1,20 @@
+.ca-info-title {
+  font: var(--t-body-xs-500);
+}
+
+.ca-info-grid {
+  display: grid;
+  grid-template-columns: 180px 1fr;
+  gap: var(--spacing-md) var(--spacing-lg);
+  align-items: center;
+
+  .ca-info-label {
+    color: var(--fg-neutral);
+    font: var(--t-body-sm-400);
+  }
+
+  .ca-info-value {
+    color: var(--fg-faded);
+    font: var(--t-body-sm-500);
+  }
+}
diff --git a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
index 90d00e323a..0f0358625f 100644
--- a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
+++ b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
@@ -9,6 +9,8 @@ import { SettingsLayout } from '../../../shared/components/SettingsLayout/Settin
 import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
 import { getSettingsQueryOptions } from '../../../shared/query';
 import { useQuery } from '@tanstack/react-query';
+import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
+import { ThemeSpacing } from '../../../shared/defguard-ui/types';
 
 const breadcrumbs = [
   <Link
@@ -36,17 +38,15 @@ export const SettingsCertificatesPage = () => {
           title={m.settings_certs_certs_title()}
           subtitle={m.settings_certs_certs_description()}
         />
-        {isPresent(settings) && (
-          <SettingsCard>
-            <Content settings={settings} />
-          </SettingsCard>
-        )}
+        <SettingsCard>
+          <SizedBox height={ThemeSpacing.Xl2} />
+          <Content />
+        </SettingsCard>
       </SettingsLayout>
     </Page>
   );
 };
 
-const Content = ({ settings }: { settings: Settings }) => {
-  console.log(settings);
+const Content = () => {
   return (<div>TODO</div>);
 };

From 75e71aee01813563b7501f5a4502ef1ccfb9f70b Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Mon, 30 Mar 2026 12:57:14 +0200
Subject: [PATCH 04/29] download CA cert button

---
 web/messages/en/settings.json                         |  3 +++
 .../pages/settings/SettingsCaPage/SettingsCaPage.tsx  | 11 +++++++----
 web/src/pages/settings/SettingsCaPage/style.scss      |  1 +
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/web/messages/en/settings.json b/web/messages/en/settings.json
index 3d59b05b93..b150ea95a0 100644
--- a/web/messages/en/settings.json
+++ b/web/messages/en/settings.json
@@ -34,6 +34,9 @@
   "settings_certs_ca_certificate_validated_title": "Certificate Validated",
   "settings_certs_ca_certificate_validated": "Your uploaded Certificate has been successfully validated. All required files were checked and confirmed as correct and ready for use. You can download the validated certificate files if needed for your setup.",
   "settings_certs_ca_information_extracted": "Information extracted from uploaded files",
+  "settings_certs_ca_download": "Download CA certificate",
+  "settings_certs_ca_email": "Email",
+  "settings_certs_ca_valid_until": "Valid until",
   "settings_certs_certs_title": "Edge/Core Certificates",
   "settings_certs_certs_description": "Add and manage certificates issued outside of Defguard. Use them to integrate existing infrastructure and maintain secure connections with external systems and services.",
   "settings_vpn_stats_toggle_title": "Stats purge",
diff --git a/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx b/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
index 02c89be0f7..bf3d415bcb 100644
--- a/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
+++ b/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
@@ -13,6 +13,7 @@ import caIconSrc from '../../SetupPage/assets/ca.png';
 import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { ThemeSpacing } from '../../../shared/defguard-ui/types';
 import { Divider } from '../../../shared/defguard-ui/components/Divider/Divider';
+import { Button } from '../../../shared/defguard-ui/components/Button/Button';
 
 const breadcrumbs = [
   <Link
@@ -63,12 +64,14 @@ const Content = () => {
       <p className='ca-info-title'>{m.settings_certs_ca_information_extracted()}</p>
       <Divider spacing={ThemeSpacing.Md}/>
       <div className='ca-info-grid'>
-        <div className='ca-info-label'>Email</div>
-        <div className='ca-info-value'>test@mail.com</div>
-        <div className='ca-info-label'>Valid by</div>
-        <div className='ca-info-value'>25/03/2057  | 16:23:00</div>
+        <div className='ca-info-label'>{m.settings_certs_ca_email()}</div>
+        <div className='ca-info-value'>TODO</div>
+        <div className='ca-info-label'>{m.settings_certs_ca_valid_until()}</div>
+        <div className='ca-info-value'>TODO</div>
       </div>
       <Divider spacing={ThemeSpacing.Md}/>
+      <SizedBox height={ThemeSpacing.Xl2} />
+      <Button variant='outlined' text={m.settings_certs_ca_download()} iconLeft='download'/>
     </ActionableSection>
   );
 };
diff --git a/web/src/pages/settings/SettingsCaPage/style.scss b/web/src/pages/settings/SettingsCaPage/style.scss
index 152830646a..32e955be58 100644
--- a/web/src/pages/settings/SettingsCaPage/style.scss
+++ b/web/src/pages/settings/SettingsCaPage/style.scss
@@ -18,3 +18,4 @@
     font: var(--t-body-sm-500);
   }
 }
+

From 8b8156bdddb4a8179446cf34cf2c694cfc46ed79 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Tue, 31 Mar 2026 09:56:50 +0200
Subject: [PATCH 05/29] settings CA page

---
 .../defguard_core/src/handlers/core_certs.rs  | 54 ++++++++++++++++++-
 crates/defguard_core/src/lib.rs               |  3 +-
 .../src/handlers/initial_wizard.rs            |  8 ++-
 .../SettingsCaPage/SettingsCaPage.tsx         | 52 +++++++++++++-----
 .../pages/settings/SettingsCaPage/style.scss  |  1 -
 .../SettingsCertificatesPage.tsx              |  7 +--
 .../SettingsIndexPage/SettingsIndexPage.tsx   |  2 +-
 .../SettingsCertificatesTab.tsx               | 12 ++---
 .../_authorized/_default/settings/ca.tsx      |  2 +-
 .../_authorized/_default/settings/certs.tsx   |  2 +-
 web/src/shared/api/api.ts                     |  1 +
 11 files changed, 111 insertions(+), 33 deletions(-)

diff --git a/crates/defguard_core/src/handlers/core_certs.rs b/crates/defguard_core/src/handlers/core_certs.rs
index 43ed0493d2..f3a228546c 100644
--- a/crates/defguard_core/src/handlers/core_certs.rs
+++ b/crates/defguard_core/src/handlers/core_certs.rs
@@ -1,6 +1,8 @@
-use axum::{Json, extract::State, http::StatusCode};
-use defguard_certs::{CertificateAuthority, Csr, DnType, generate_key_pair};
+use axum::{Extension, Json, extract::State, http::StatusCode};
+use serde_json::json;
+use defguard_certs::{CertificateAuthority, CertificateInfo, Csr, DnType, der_to_pem, generate_key_pair};
 use defguard_common::db::models::{Certificates, CoreCertSource};
+use sqlx::PgPool;
 use utoipa::ToSchema;
 
 use crate::{
@@ -160,3 +162,51 @@ pub(crate) async fn core_cert_self_signed(
     );
     Ok(ApiResponse::default())
 }
+
+#[utoipa::path(
+    post,
+    path = "/api/v1/core/cert/ca",
+    responses(
+        (status = 200, description = "Self-signed certificate provisioned.", body = ApiResponse),
+        (status = 400, description = "Invalid request (e.g. CA not configured).", body = ApiResponse),
+        (status = 401, description = "Unauthorized.", body = ApiResponse),
+        (status = 403, description = "Forbidden.", body = ApiResponse),
+        (status = 500, description = "Internal server error.", body = ApiResponse)
+    ),
+    security(("cookie" = []), ("api_token" = []))
+)]
+pub(crate) async fn get_ca(
+    _role: AdminRole,
+    session: SessionInfo,
+	Extension(pool): Extension<PgPool>,
+) -> ApiResult {
+    debug!("Fetching certificate authority details");
+    let certs = Certificates::get_or_default(&pool)
+        .await
+        .map_err(WebError::from)?;
+    if let Some(ca_cert_der) = certs.ca_cert_der {
+        let ca_pem = der_to_pem(&ca_cert_der, defguard_certs::PemLabel::Certificate)?;
+        let info = CertificateInfo::from_der(&ca_cert_der)?;
+        let valid_for_days = (info.not_after.and_utc() - chrono::Utc::now()).num_days();
+
+        debug!(
+            "Certificate authority details prepared: subject_common_name={}, valid_for_days={}",
+            info.subject_common_name, valid_for_days
+        );
+
+        Ok(ApiResponse::new(
+            json!({
+				"ca_cert_pem": ca_pem,
+				"subject_common_name": info.subject_common_name,
+				"not_before": info.not_before,
+				"not_after": info.not_after,
+				"valid_for_days": valid_for_days
+			}),
+            StatusCode::OK,
+        ))
+    } else {
+        Err(WebError::ObjectNotFound(
+            "CA certificate not found".to_string(),
+        ))
+    }
+}
diff --git a/crates/defguard_core/src/lib.rs b/crates/defguard_core/src/lib.rs
index 4d9c3b7bc9..808096520e 100644
--- a/crates/defguard_core/src/lib.rs
+++ b/crates/defguard_core/src/lib.rs
@@ -117,7 +117,7 @@ use crate::{
             webauthn_start,
         },
         component_setup::setup_gateway_tls_stream,
-        core_certs::{core_cert_self_signed, core_cert_upload},
+        core_certs::{core_cert_self_signed, core_cert_upload, get_ca},
         forward_auth::forward_auth,
         gateway::{delete_gateway, gateway_details, gateway_list, update_gateway},
         group::{
@@ -385,6 +385,7 @@ pub fn build_webapp(
             // Core HTTPS cert routes
             .route("/core/cert/upload", post(core_cert_upload))
             .route("/core/cert/self-signed", post(core_cert_self_signed))
+			.route("/core/cert/ca", get(get_ca))
             // Gateway routes
             .route("/gateway", get(gateway_list))
             .route(
diff --git a/crates/defguard_setup/src/handlers/initial_wizard.rs b/crates/defguard_setup/src/handlers/initial_wizard.rs
index 49f36964f1..9a4bdd1e2d 100644
--- a/crates/defguard_setup/src/handlers/initial_wizard.rs
+++ b/crates/defguard_setup/src/handlers/initial_wizard.rs
@@ -405,7 +405,13 @@ pub async fn get_ca(_: AdminOrSetupRole, Extension(pool): Extension<PgPool>) ->
         }
 
         Ok(ApiResponse::new(
-            json!({ "ca_cert_pem": ca_pem, "subject_common_name": info.subject_common_name, "not_before": info.not_before, "not_after": info.not_after, "valid_for_days": valid_for_days }),
+            json!({
+				"ca_cert_pem": ca_pem,
+				"subject_common_name": info.subject_common_name,
+				"not_before": info.not_before,
+				"not_after": info.not_after,
+				"valid_for_days": valid_for_days
+			}),
             StatusCode::OK,
         ))
     } else {
diff --git a/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx b/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
index bf3d415bcb..a8c8bbca6b 100644
--- a/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
+++ b/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
@@ -1,19 +1,24 @@
 import './style.scss';
+import { useQuery } from '@tanstack/react-query';
 import { Link } from '@tanstack/react-router';
+import { useCallback } from 'react';
 import { m } from '../../../paraglide/messages';
+import api from '../../../shared/api/api';
 import { Breadcrumbs } from '../../../shared/components/Breadcrumbs/Breadcrumbs';
+import { DescriptionBlock } from '../../../shared/components/DescriptionBlock/DescriptionBlock';
 import { Page } from '../../../shared/components/Page/Page';
 import { SettingsCard } from '../../../shared/components/SettingsCard/SettingsCard';
 import { SettingsHeader } from '../../../shared/components/SettingsHeader/SettingsHeader';
 import { SettingsLayout } from '../../../shared/components/SettingsLayout/SettingsLayout';
-import { DescriptionBlock } from '../../../shared/components/DescriptionBlock/DescriptionBlock';
 import { ActionableSection } from '../../../shared/defguard-ui/components/ActionableSection/ActionableSection';
 import { ActionableSectionVariant } from '../../../shared/defguard-ui/components/ActionableSection/types';
-import caIconSrc from '../../SetupPage/assets/ca.png';
+import { Button } from '../../../shared/defguard-ui/components/Button/Button';
+import { Divider } from '../../../shared/defguard-ui/components/Divider/Divider';
 import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { ThemeSpacing } from '../../../shared/defguard-ui/types';
-import { Divider } from '../../../shared/defguard-ui/components/Divider/Divider';
-import { Button } from '../../../shared/defguard-ui/components/Button/Button';
+import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
+import { downloadFile } from '../../../shared/utils/download';
+import caIconSrc from '../../SetupPage/assets/ca.png';
 
 const breadcrumbs = [
   <Link
@@ -53,6 +58,20 @@ export const SettingsCaPage = () => {
 };
 
 const Content = () => {
+  const { data: caData, isFetching } = useQuery({
+    queryKey: ['core', 'cert', 'ca'],
+    queryFn: api.core.getCA,
+    select: (resp) => resp.data,
+  });
+
+  const handleDownloadCA = useCallback(() => {
+    const caPem = caData?.ca_cert_pem;
+    if (!isPresent(caPem)) return;
+    const blob = new Blob([caPem], {
+      type: 'application/x-pem-file;charset=utf-8',
+    });
+    downloadFile(blob, 'defguard-ca', 'pem');
+  }, [caData?.ca_cert_pem]);
   return (
     <ActionableSection
       variant={ActionableSectionVariant.Secondary}
@@ -61,17 +80,24 @@ const Content = () => {
       imageSrc={caIconSrc}
     >
       <SizedBox height={ThemeSpacing.Xl3} />
-      <p className='ca-info-title'>{m.settings_certs_ca_information_extracted()}</p>
-      <Divider spacing={ThemeSpacing.Md}/>
-      <div className='ca-info-grid'>
-        <div className='ca-info-label'>{m.settings_certs_ca_email()}</div>
-        <div className='ca-info-value'>TODO</div>
-        <div className='ca-info-label'>{m.settings_certs_ca_valid_until()}</div>
-        <div className='ca-info-value'>TODO</div>
+      <p className="ca-info-title">{m.settings_certs_ca_information_extracted()}</p>
+      <Divider spacing={ThemeSpacing.Md} />
+      <div className="ca-info-grid">
+        <div className="ca-info-label">{m.settings_certs_ca_email()}</div>
+        <div className="ca-info-value">TODO</div>
+        <div className="ca-info-label">{m.settings_certs_ca_valid_until()}</div>
+        <div className="ca-info-value">TODO</div>
       </div>
-      <Divider spacing={ThemeSpacing.Md}/>
+      <Divider spacing={ThemeSpacing.Md} />
       <SizedBox height={ThemeSpacing.Xl2} />
-      <Button variant='outlined' text={m.settings_certs_ca_download()} iconLeft='download'/>
+      <Button
+        variant="outlined"
+        iconLeft="download"
+        text={m.settings_certs_ca_download()}
+        onClick={handleDownloadCA}
+        loading={isFetching}
+        disabled={!isPresent(caData?.ca_cert_pem) || isFetching}
+      />
     </ActionableSection>
   );
 };
diff --git a/web/src/pages/settings/SettingsCaPage/style.scss b/web/src/pages/settings/SettingsCaPage/style.scss
index 32e955be58..152830646a 100644
--- a/web/src/pages/settings/SettingsCaPage/style.scss
+++ b/web/src/pages/settings/SettingsCaPage/style.scss
@@ -18,4 +18,3 @@
     font: var(--t-body-sm-500);
   }
 }
-
diff --git a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
index 0f0358625f..2cf6dd7707 100644
--- a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
+++ b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
@@ -1,14 +1,10 @@
 import { Link } from '@tanstack/react-router';
 import { m } from '../../../paraglide/messages';
-import type { Settings } from '../../../shared/api/types';
 import { Breadcrumbs } from '../../../shared/components/Breadcrumbs/Breadcrumbs';
 import { Page } from '../../../shared/components/Page/Page';
 import { SettingsCard } from '../../../shared/components/SettingsCard/SettingsCard';
 import { SettingsHeader } from '../../../shared/components/SettingsHeader/SettingsHeader';
 import { SettingsLayout } from '../../../shared/components/SettingsLayout/SettingsLayout';
-import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
-import { getSettingsQueryOptions } from '../../../shared/query';
-import { useQuery } from '@tanstack/react-query';
 import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { ThemeSpacing } from '../../../shared/defguard-ui/types';
 
@@ -28,7 +24,6 @@ const breadcrumbs = [
 ];
 
 export const SettingsCertificatesPage = () => {
-  const { data: settings } = useQuery(getSettingsQueryOptions);
   return (
     <Page title={m.settings_page_title()}>
       <Breadcrumbs links={breadcrumbs} />
@@ -48,5 +43,5 @@ export const SettingsCertificatesPage = () => {
 };
 
 const Content = () => {
-  return (<div>TODO</div>);
+  return <div>TODO</div>;
 };
diff --git a/web/src/pages/settings/SettingsIndexPage/SettingsIndexPage.tsx b/web/src/pages/settings/SettingsIndexPage/SettingsIndexPage.tsx
index 109d3fb2df..278886f74d 100644
--- a/web/src/pages/settings/SettingsIndexPage/SettingsIndexPage.tsx
+++ b/web/src/pages/settings/SettingsIndexPage/SettingsIndexPage.tsx
@@ -7,12 +7,12 @@ import { Tabs } from '../../../shared/defguard-ui/components/Tabs/Tabs';
 import type { TabProps } from '../../../shared/defguard-ui/components/Tabs/types';
 import { ThemeSpacing } from '../../../shared/defguard-ui/types';
 import { SettingsActivityLogStreamingPage } from '../SettingsActivityLogStreamingPage/SettingsActivityStreamingTab';
+import { SettingsCertificatesTab } from './tabs/SettingsCertificatesTab/SettingsCertificatesTab';
 import { SettingsExternalProvidersTab } from './tabs/SettingsExternalProvidersTab';
 import { SettingsGeneralTab } from './tabs/SettingsGeneralTab';
 import { SettingsLicenseTab } from './tabs/SettingsLicenseTab/SettingsLicenseTab';
 import { SettingsNotificationsTab } from './tabs/SettingsNotificationsTab';
 import { type SettingsTabValue, settingsTabsSchema } from './types';
-import { SettingsCertificatesTab } from './tabs/SettingsCertificatesTab/SettingsCertificatesTab';
 
 const tabComponent: Record<SettingsTabValue, JSX.Element> = {
   general: <SettingsGeneralTab />,
diff --git a/web/src/pages/settings/SettingsIndexPage/tabs/SettingsCertificatesTab/SettingsCertificatesTab.tsx b/web/src/pages/settings/SettingsIndexPage/tabs/SettingsCertificatesTab/SettingsCertificatesTab.tsx
index 74828cc093..078810e016 100644
--- a/web/src/pages/settings/SettingsIndexPage/tabs/SettingsCertificatesTab/SettingsCertificatesTab.tsx
+++ b/web/src/pages/settings/SettingsIndexPage/tabs/SettingsCertificatesTab/SettingsCertificatesTab.tsx
@@ -1,9 +1,9 @@
-import { Link } from "@tanstack/react-router";
-import { SettingsLayout } from "../../../../../shared/components/SettingsLayout/SettingsLayout";
-import { SectionSelect } from "../../../../../shared/defguard-ui/components/SectionSelect/SectionSelect";
+import { Link } from '@tanstack/react-router';
 import { m } from '../../../../../paraglide/messages';
-import { SizedBox } from "../../../../../shared/defguard-ui/components/SizedBox/SizedBox";
-import { ThemeSpacing } from "../../../../../shared/defguard-ui/types";
+import { SettingsLayout } from '../../../../../shared/components/SettingsLayout/SettingsLayout';
+import { SectionSelect } from '../../../../../shared/defguard-ui/components/SectionSelect/SectionSelect';
+import { SizedBox } from '../../../../../shared/defguard-ui/components/SizedBox/SizedBox';
+import { ThemeSpacing } from '../../../../../shared/defguard-ui/types';
 
 export const SettingsCertificatesTab = () => {
   return (
@@ -25,4 +25,4 @@ export const SettingsCertificatesTab = () => {
       </Link>
     </SettingsLayout>
   );
-}
+};
diff --git a/web/src/routes/_authorized/_default/settings/ca.tsx b/web/src/routes/_authorized/_default/settings/ca.tsx
index 6dec5b74ca..b9b8fe7767 100644
--- a/web/src/routes/_authorized/_default/settings/ca.tsx
+++ b/web/src/routes/_authorized/_default/settings/ca.tsx
@@ -1,4 +1,4 @@
-import { createFileRoute } from '@tanstack/react-router'
+import { createFileRoute } from '@tanstack/react-router';
 import { SettingsCaPage } from '../../../../pages/settings/SettingsCaPage/SettingsCaPage';
 
 export const Route = createFileRoute('/_authorized/_default/settings/ca')({
diff --git a/web/src/routes/_authorized/_default/settings/certs.tsx b/web/src/routes/_authorized/_default/settings/certs.tsx
index b8a0fd6112..55418de2a8 100644
--- a/web/src/routes/_authorized/_default/settings/certs.tsx
+++ b/web/src/routes/_authorized/_default/settings/certs.tsx
@@ -1,4 +1,4 @@
-import { createFileRoute } from '@tanstack/react-router'
+import { createFileRoute } from '@tanstack/react-router';
 import { SettingsCertificatesPage } from '../../../../pages/settings/SettingsCertificatesPage/SettingsCertificatesPage';
 
 export const Route = createFileRoute('/_authorized/_default/settings/certs')({
diff --git a/web/src/shared/api/api.ts b/web/src/shared/api/api.ts
index 39c8e5e5ff..54b4f856c1 100644
--- a/web/src/shared/api/api.ts
+++ b/web/src/shared/api/api.ts
@@ -481,6 +481,7 @@ const api = {
       client.post('/core/cert/self-signed', data),
     certUpload: (data: { cert_pem: string; key_pem: string }) =>
       client.post('/core/cert/upload', data),
+    getCA: () => client.get<GetCAResponse>('/core/cert/ca'),
   },
   acl: {
     destination: {

From ee33e578a7815b2d5acca884ca62e7c8f1124374 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Tue, 31 Mar 2026 10:53:01 +0200
Subject: [PATCH 06/29] extract CA email

---
 crates/defguard_certs/src/lib.rs              | 52 ++++++++++---------
 .../defguard_core/src/handlers/core_certs.rs  |  7 +--
 .../SettingsCaPage/SettingsCaPage.tsx         |  5 +-
 web/src/shared/api/types.ts                   |  2 +
 4 files changed, 36 insertions(+), 30 deletions(-)

diff --git a/crates/defguard_certs/src/lib.rs b/crates/defguard_certs/src/lib.rs
index 4fb9f3e124..970e786dc2 100644
--- a/crates/defguard_certs/src/lib.rs
+++ b/crates/defguard_certs/src/lib.rs
@@ -1,15 +1,19 @@
 use std::str::FromStr;
 
-use base64::{Engine, prelude::BASE64_STANDARD};
+use base64::{prelude::BASE64_STANDARD, Engine};
 use chrono::NaiveDateTime;
 use rcgen::{
-    BasicConstraints, Certificate, CertificateParams, CertificateSigningRequestParams,
-    ExtendedKeyUsagePurpose, IsCa, Issuer, KeyPair, KeyUsagePurpose, SigningKey, string::Ia5String,
+    string::Ia5String, BasicConstraints, Certificate, CertificateParams,
+    CertificateSigningRequestParams, ExtendedKeyUsagePurpose, IsCa, Issuer, KeyPair,
+    KeyUsagePurpose, SigningKey,
 };
-use rustls_pki_types::{CertificateDer, CertificateSigningRequestDer, pem::PemObject};
+use rustls_pki_types::{pem::PemObject, CertificateDer, CertificateSigningRequestDer};
 use thiserror::Error;
 use time::{Duration, OffsetDateTime};
-use x509_parser::parse_x509_certificate;
+use x509_parser::{
+    extensions::{GeneralName, ParsedExtension},
+    parse_x509_certificate,
+};
 
 const CA_NAME: &str = "Defguard CA";
 const NOT_BEFORE_OFFSET_SECS: Duration = Duration::minutes(5);
@@ -144,6 +148,7 @@ impl CertificateAuthority<'_> {
 
 pub struct CertificateInfo {
     pub subject_common_name: String,
+    pub subject_email: Option<String>,
     pub not_before: NaiveDateTime,
     pub not_after: NaiveDateTime,
     pub serial: String,
@@ -158,6 +163,17 @@ impl CertificateInfo {
 
         let subject = &parsed.tbs_certificate.subject;
         let serial = parsed.raw_serial_as_string();
+        let subject_email = parsed.tbs_certificate.extensions().iter().find_map(|ext| {
+            match ext.parsed_extension() {
+                ParsedExtension::SubjectAlternativeName(san) => {
+                    san.general_names.iter().find_map(|name| match name {
+                        GeneralName::RFC822Name(email) => Some(email.to_string()),
+                        _ => None,
+                    })
+                }
+                _ => None,
+            }
+        });
 
         let cn = subject
             .iter_common_name()
@@ -174,6 +190,7 @@ impl CertificateInfo {
 
         Ok(Self {
             subject_common_name: cn.to_string(),
+            subject_email,
             not_before: chrono::DateTime::from_timestamp(not_before.unix_timestamp(), 0)
                 .ok_or_else(|| {
                     CertificateError::ParsingError(format!(
@@ -425,30 +442,15 @@ mod tests {
 
     #[test]
     fn test_ca_email() {
-        use x509_parser::parse_x509_certificate;
-
         let expected_email = "contact@defguard.net";
         let ca = CertificateAuthority::new("Test CA", expected_email, 365).unwrap();
 
-        let (_rem, parsed) = parse_x509_certificate(ca.cert_der()).unwrap();
-
-        let san_ext = parsed
-            .tbs_certificate
-            .extensions()
-            .iter()
-            .find(|ext| ext.oid == x509_parser::oid_registry::OID_X509_EXT_SUBJECT_ALT_NAME)
-            .expect("Subject Alternative Name extension not found");
-
-        let san_value = san_ext.value;
-
-        let email_bytes = expected_email.as_bytes();
-        let email_found = san_value
-            .windows(email_bytes.len())
-            .any(|window| window == email_bytes);
+        let info = CertificateInfo::from_der(ca.cert_der()).unwrap();
 
-        assert!(
-            email_found,
-            "Email '{expected_email}' should be present in Subject Alternative Names"
+        assert_eq!(
+            info.subject_email.as_deref(),
+            Some(expected_email),
+            "Email should be parsed from Subject Alternative Names"
         );
     }
 
diff --git a/crates/defguard_core/src/handlers/core_certs.rs b/crates/defguard_core/src/handlers/core_certs.rs
index f3a228546c..80d002b9a4 100644
--- a/crates/defguard_core/src/handlers/core_certs.rs
+++ b/crates/defguard_core/src/handlers/core_certs.rs
@@ -167,7 +167,7 @@ pub(crate) async fn core_cert_self_signed(
     post,
     path = "/api/v1/core/cert/ca",
     responses(
-        (status = 200, description = "Self-signed certificate provisioned.", body = ApiResponse),
+        (status = 200, description = "CA cert data", body = ApiResponse),
         (status = 400, description = "Invalid request (e.g. CA not configured).", body = ApiResponse),
         (status = 401, description = "Unauthorized.", body = ApiResponse),
         (status = 403, description = "Forbidden.", body = ApiResponse),
@@ -177,7 +177,6 @@ pub(crate) async fn core_cert_self_signed(
 )]
 pub(crate) async fn get_ca(
     _role: AdminRole,
-    session: SessionInfo,
 	Extension(pool): Extension<PgPool>,
 ) -> ApiResult {
     debug!("Fetching certificate authority details");
@@ -200,7 +199,9 @@ pub(crate) async fn get_ca(
 				"subject_common_name": info.subject_common_name,
 				"not_before": info.not_before,
 				"not_after": info.not_after,
-				"valid_for_days": valid_for_days
+				"valid_for_days": valid_for_days,
+				"ca_expiry": certs.ca_expiry,
+				"subject_email": info.subject_email,
 			}),
             StatusCode::OK,
         ))
diff --git a/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx b/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
index a8c8bbca6b..c1c081c56d 100644
--- a/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
+++ b/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
@@ -19,6 +19,7 @@ import { ThemeSpacing } from '../../../shared/defguard-ui/types';
 import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
 import { downloadFile } from '../../../shared/utils/download';
 import caIconSrc from '../../SetupPage/assets/ca.png';
+import { displayDate } from '../../../shared/utils/displayDate';
 
 const breadcrumbs = [
   <Link
@@ -84,9 +85,9 @@ const Content = () => {
       <Divider spacing={ThemeSpacing.Md} />
       <div className="ca-info-grid">
         <div className="ca-info-label">{m.settings_certs_ca_email()}</div>
-        <div className="ca-info-value">TODO</div>
+        <div className="ca-info-value">{caData?.subject_email}</div>
         <div className="ca-info-label">{m.settings_certs_ca_valid_until()}</div>
-        <div className="ca-info-value">TODO</div>
+        <div className="ca-info-value">{caData?.ca_expiry ? displayDate(caData?.ca_expiry) : '-'}</div>
       </div>
       <Divider spacing={ThemeSpacing.Md} />
       <SizedBox height={ThemeSpacing.Xl2} />
diff --git a/web/src/shared/api/types.ts b/web/src/shared/api/types.ts
index ee1539e0e1..ff9f40b407 100644
--- a/web/src/shared/api/types.ts
+++ b/web/src/shared/api/types.ts
@@ -49,6 +49,8 @@ export interface GetCAResponse {
   not_before: string;
   not_after: string;
   valid_for_days: number;
+  ca_expiry: string;
+  subject_email: string | null;
 }
 
 export interface UploadCARequest {

From 3ed451fdb5c7b0cd27d291850e62e4e8a62596f1 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Tue, 31 Mar 2026 11:16:25 +0200
Subject: [PATCH 07/29] move ca image

---
 .../settings/SettingsCaPage/SettingsCaPage.tsx  |   2 +-
 .../pages/settings/SettingsCaPage/assets/ca.png | Bin 0 -> 19105 bytes
 2 files changed, 1 insertion(+), 1 deletion(-)
 create mode 100644 web/src/pages/settings/SettingsCaPage/assets/ca.png

diff --git a/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx b/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
index c1c081c56d..5cfccde717 100644
--- a/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
+++ b/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
@@ -18,7 +18,7 @@ import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedB
 import { ThemeSpacing } from '../../../shared/defguard-ui/types';
 import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
 import { downloadFile } from '../../../shared/utils/download';
-import caIconSrc from '../../SetupPage/assets/ca.png';
+import caIconSrc from './assets/ca.png';
 import { displayDate } from '../../../shared/utils/displayDate';
 
 const breadcrumbs = [
diff --git a/web/src/pages/settings/SettingsCaPage/assets/ca.png b/web/src/pages/settings/SettingsCaPage/assets/ca.png
new file mode 100644
index 0000000000000000000000000000000000000000..d226215667409442ac568d4a78f8fd98b602ac62
GIT binary patch
literal 19105
zcmV)TK(W7xP)<h;3K|Lk000e1NJLTq006WA007Ad1^@s6ig6e%00009a7bBm000&x
z000&x0ZCFM@Bjb+0drDELIAGL9O(c600d`2O+f$vv5yP<VFdsHN;XMEK~#7F?R^Q5
zT*aB@pYK(5x9)>mAP_f3*a%}Tn?u+f_Kxu}VZh#<wZYfyOpM0{CSt~R#8~XajyEQT
z!^7<CjIj-#*su+DgbmmO0&FC17y;rCAP`6(frJ2EE%jCPUT*$*{+Tadb#-^Ox~l0P
zTJ`F^eEE+0^3U%-GLylSjEgM&tJ+e|`S&>RMVzy%AGo&bW|)$37Y0+(Qd#;p{fl@l
z5kQ8^f<qgUYJTpD|2=I3Ov$*(6rfuqOPBGv`L6mmf#u&4U+2#30r_@!_XFVe?g3Sf
z0lS%1v#Y0oJwB4al#E%HUN!g`-aGV^0P`~Ob?%vq6Zr9!RRLtBFMjanRk-|uRBj6j
za#>zW)}MW4?R(e=U`kplQyO{<LU{60{J!MKL;yFDpD369uNrLG&f%8tR^h;T47P0J
z@Z-A%;J&AZAcHF8ys{zW*GAJb#urU#@{!9FphqDJbhYmR<47+grMUdU6h3!W>XoB_
z-gj0GgM)*R=Q(WM!QpRzn!#H;0W#hLIV2mBgnbsWYzb$Qe=pKiYyh6zeE+r8t6@r-
zk|{usP>?DZo{Zm-N__6D1ZGYvzDfl2TibKE>B>w3I+XjK&f%67Ic(n1B{X)W(PcMG
zc}kj-DGuGFAiX%}s=@V!CnK%6<vUflOaM9tW<f>7%dJ6$^+TRz(K=5(Hi2Uo^;j^Y
zrvLWmE0Ug|eB;x&EjJel3Ubpqe>M0NdQo6XN~HoV644D;dI7rT^>42Zuq3I}k`yL`
zBt3@+n(%|1=V#+r1Q>$O@Z^}(YIR935YSARfuZaX9*^4|OX0Rh6S2)CkS{*lY5JR%
zs|Il92~6zkg1c7baP#sSyuD*+Nmi?_Kj+H9|Ho2x4derxphKlwywKg%*|q9)s2%er
zWIy~Nt3eB7Oo0BxH+Xk#`u3jfgWc0>eSHi)RsGP7raaU-9M09WGMf+at9Z`8ip;Ex
zCsV1{GZ-2Y249IrMtOEa0@vS`!dp9(7RHA0?MqWQaDJTqp{76g{dG9zz#9Bvwcz6`
z2OwkBKgsgyr#SEWQC`We3Gcf;m|qGBzl$e)Beba~eDw9y`T*7l@^;#Hc4yVRJ~V63
zoW476V1qD985N*UUdE@->g}DrEA8t7-VHrnFsX#qldolUxRNn88^2#HG-nyLKta%<
zMn=tCCa-P*xN&(!0vhG01&UHM()2?^HQ2MKChOmCj^O0yByjGDOn|x$e|Wk!J7Zl}
zvaE73XZ+ec$!<;Z^pZT|S0yYtL@1SIg3H{Rv+UY-2DXt(ouwSA({@ekn}*=7cg^U1
zVj1g$5z2^+Le$9pUA?nvX*$UutR&%;Gm;#x79GrD{ElGz#-~y^>fmx9Bj{>11-elF
z$3NADM+4xj6T9K}tCePNM$>=c?+4)R?L+Wyf5~9~x$$eSd5yyjzd=t)3Uw~@3NQri
z!bs7L;@*B4YVuBydWC26dpGa6^M<3F*4Rw}df76b+|j>%RuAu<0h3Tz&K4#-y-sYN
zf!~|q$w)5-1_lL?^U^Y3{{aXOMis#(zYnMB(WQr!<tx_=NY~!K{$-^U&?v~ozxi(o
zY}uhY+G#?~EIu@WRqJxm12FlA{9DULqsgJeWPlCsxoFzF-et>JK3v&hDaX=f_f_s3
z+Ov-U^W-q{h#=q02Km<nq`xXKH#;=WVlrMlxsj$1B{V9h3$x{8A4uUN$1&LOHWz>f
zdH>ib&pIK88*Zx$e>f~;oL!e@l}iK-xuO$jh!Iqz0)ssQi|?*jc5b~<*@l2V`Rlye
zyQ6Pk!I3AOzZ&_b;K^4Tp8W9-33~DA;dt_p1YMcDCFsTVw>h5NoTje}O+VC7(^Cl>
z%dtWWU-q#S_L;?CU`WI)gZ6Od35obqo|2oEOJJWNdZR}>iC?22$L@zy_WAnP`L;$L
zky1b-m|^<l12ghu(Q#b`NH171TpbhCo~V_}w5QRSKU?8=GHUwEE*P6fgi2^sF5Fib
ziDy>em<7%KJlJ5D98rZ|K9Iw&9+20(L;(8?Uhf=!ji7#M&K?ByyJet`0vc(?WYf$@
zFY+P45b`DX9YObv&s5|OT_(-&WbF2TwlbAnKT2~Rk;a;y3N{w3|F%a}<3M_G(J3jM
z_kpC~;pX<AxFF@hUI_2;rn@uL+6zSwb!AFCCD7(lV=O^X3yi)KqaOu8BbfV#PT6O&
zfZ6b5K`*|_n&io7oFR~h<H<i;nOKe4jHWk0ZiXkLpw_>4wQDTrotOwPCosLszi(Sz
zbJa><cQU_5P}c=Ug|p)A&`>M@x;}8ytV+%%g#n24A|K+{3oUdAes9(|Ln=@v$dj?_
zfAmGilTp)S%4nH1qv^f-fD~$i@!kDY0`q4wIAk9NmwzmgJlTL2KbZJ0rzjRJ7Fd(0
zhR){KNIxFw--Y=!+r0hs3kFPhU*9z7bji}iDKMlLXW-A?Y!IUvo?I5Lj!83`o{BLl
zxArEmU|$9Y&13M14<>NfzRaT&<_;y8gMH9Eo~;;uErETv<<}n<{Q5`j%&&J>E5h@^
zdsZxC17@EG=*rNZS)H7KXT#O#h689>xEi(bjmw>90Reznc8xUsNO>|gmS5bT!rU1Q
zjunBN(~e<qj?ns|okhV++Z`v@9R;4H;Ikn2$7j?0dUhx9>;9oVa|HDmGStHY8ntt!
zudidN#z@1}s67#M=r${p(eUKqG<_(>sH|2JShPRDhu@b7AT#KxGRSgY;TCFSBj?Y<
ziQ(6uI3<Vg|HAR>q+a<dPqMGH8x29~aZepE;MXg^+XEe{os}DoUk@YX$&HM&(6i92
zrZ)-v&4_6%>oyCXEV%Le4iOqzaN0%tsr$w|t7i}es=00N_F2m?Ek&lse%IsIi&>lU
z>nh(fLulzesHG*KJ5f9P;c7O5w9fJ%#@^z|XjDG2E`fb#GZCt0@NvPDk!C1MPpMsO
z7v?rSB^=?*tpsu?oxrcr>#+g=^NR)~pfPi<mUaf7jT;X69e!_B5MytJtAG1=0+lp@
zqlKaR;o}lG{a6OwRThwACbTp6C`IUFX1eHjg4sw%@ax{*nSf~@u#6`k>FYZXIzW&o
zGf1vPe=>fbsI*R#z~3xSHb!Ot5R>%cghLalmFLbd_et(qe;*w3_d(PMr2DuCeFMC(
ziNlQoba?+i__LOc-|%GhE0$jy*(hkp#S=+Gs-oLnI%CGx${9O1bwhPNw6oZ7HB;Ge
z!x?Ae$&*JCt`2$fsf!paMV`DrBlqf`gTCcj=5{s<X05YfZ;0X7-~7LI3GQj#u&{qH
zxjKXF%P>J=Xh$Wf9wM6Yi1VoTiXcyBd2+ST$QR=GRs}Ie8m=~JosBd-71LPmcszyu
z1W!KlKmp|UGdTSi|Gs&Y4|DL^%P^do+Z`N|y);4;L44EQIjr53!@>KihV;f@BAg1%
zHT3b4O8@rmN;T{4Za4l+(>hxnuEwta)h&)Ek0pUWCJ1E1lhF<L(G!s;C(u&~>yDqF
zM?4r_QBM)mzzUP#Zt^xqCA<5%2$f3?4F}9+aKwQLEZj%D*Vp$>&oG>%LupzW5~{kL
zoONaxkqK9~B8ag!(>izcGx=j5br6HkoSrJ4%)@&o+n__(dMCQYOX0z($AkOYdmJr9
z1hUN1yFZ8B0~}^g2e{xQ1}BO4_x4UM01a&+JEo=8N?K3SybT6ad1;-{+O*D*xZy_1
zlTBlJ=?&qAo1@%tpFLfKtM}KQiv}R`zzIq_b8`+0w77>?UZf&yd^of+05dsZ4hqtz
zFMbrCHNozHwf>5umuWR%m3)G;>PDN^Ib0Cq_p1~5;c~~5Tamy|h4N%H_>Nw{;9TU%
z$0oWyU646sM%x_$Dh5)bL6eX-bEnzO!B*3ab#DlIaeF2KjWS<2#V$EBkv-3}9{Eh-
z@=Ssn+C<PW93Q_<6VlOXok6(zBO+XlMjwW&3pGT*Y&{o&`<Vt(@ViyIMETNtG}{68
z$0SHE(BRX90OUBu^OrC<dvPkS*M-mMZo2J4%M$|V(WZ4a0v&e!KU-Omni&Oo^5qwf
zJ%OK!F)BB2XEMr%(Y;TcEbcp;L$m-w|4{4;)y@DeaN^1t4Xlhm)XtpwmGi;{Mkc=$
zAijCI;>jpy32)McCndb63Jl*nHn7yZPKLYQ>wxa?w9XedC2|xt^5j20L-~^nt~Wvh
z{QV7FZyX>G!rWdpo+dULzo?x@D@ZHQd$I0K$CE#OS^^8^Gt)HX2f78_GqfL=QT7U;
z_f}db`lpd6w>qtphO3cYoFPKi-IW+8Hhfv3(ePXzL`Fi8%d9$H0{D`KTxckxKsHYA
z`~6#dp8R>C2#!1`QTHQ2E5zPHwGxJJ7$&T?6|l!0(4$G~94?5lH_|$(QHgH2vrka;
zLUg}U$~dvv<1{z-%EUA_w%MpAM_~*~D*$?J1+{KHJPWySnS^dQ<jH3XWq^O;`81V4
zn~&-D#kdGnFlITw2J(A}a@bjjSZih>LfM;Xou;uIcW?q<I46-_3?<Ar%<Ml9A;Cqh
zYc!laC3imPc%uk3JY#WVP$&1#)A=Dt9}u{q;s|;2DMu%gUQDan`(oxM=yTH8n*uYm
zWwvq40ZrX-_{^;eVkjUd)(zKaUS^ch@MLOK?kD<_&zzP@>prbePelOcpcAI<I!=kS
zcHeREfmo}%GOqgg$P;>f+EA!;3t%2Dxc&OA9KL&VT^QRH@s1S0(R*R&#ZiJMU--d9
zMEh76li`|b5I+lNX_{yk9aFX_<7_lEXS}7QfX3Vl5#{@p*gB+>XCb<9NeUM%!EIp(
zr4eli#s>^g%5ixJ)R<P)p>C?W!8H^Ie;Q>e6eQYSeSY?g6mGf~6Nfll`uD!QfIJz2
ze9BQtk$bBK$MpR(eGjaw!oYbn1lVyTE{Ar+bL#*tHM0gYYULmNS#__6t4EvGX&TGP
zqVE5CwupkwQr}qugh$Ff5PBJ$u;RX9Zi9|U*`q1Iw34W;1+8}38EtQmi!T-ZYB1b>
z`Nt}7-*Y*<uu-8LM~)wP5R*I^uTg$$&Y;CgF)_l<^ljP}C`}E}ep<R^fL1hPcrYUs
z=<6G3IBH~XrFELd^1g#r-o<f;;5|FApwHEUlma{QBMukj;Dz$aRfqfUdp3vPuFBz0
zFBDw;AQq5{;(PRIi@Ps$tKmJP*91ZRS;37l43CCvC5_w*kI;X`C-h+sslaW*5<`TT
z4{G^dIJ6O)ZV8|<p-6mOg5Vnqm`67Y(cp;FI!$Al(XDv02p#~Kx%RosE|z}R@E4CM
zVZCplrZ{Za9mkYdF52GOO&o50D1%M!2K2;e$x_bDtvfL674VsAnbQ7v|J5|?Wgxf~
z5vHkx3Tw+<6_0L^=e0~|61wfgYrv!;nS)UVW|T%?#;)H0ZM@PtsZse^31sBS3Fu!@
z)ve1XfuETIR|$#OiT@sbDTk-mbNIUGO@;&W&OHGC@*j0r`$lk-*?)X1jeO^HZ>({F
z(#A$3Yk#tTE-#@RTtx)I*2BCUYtM<p+Rq1#GG;(4?X0LqqcC%$!Knt!&C-jJhO4Pj
z`MyIE_}clY2wmehZFohLFMX0Cm>o#gzn#NM!Bsa1uL91g(TGzH);K)2mcz<5IlQvj
zFL;cg8aPXmt~@XdBSPsyWS_2v79XYzH9?g|uT&D7d{lUR-GelzPWGOR8PMY4WtJS~
zO_YfVmc#^S>@;9Ty3$B1kAz-?MkTu8zIH)H`j!1|+(vfouPe0@qsCFO{+)dQcRiWG
zi-DFcfK1EN8#vtalyD^qP@7at6!fb6my;7X_x*`^P~zhATUvqd#x6WenZ|%;`qC<I
zBVoP<M(;*0U3xOI0@g5WBN-E*(M>1b#2M)4Y^0sbz^r_~N*jOs3zddo?(6GsDmW75
z$-?0K_(>_@q`u3|2Q7B9N>|0ejDUP}t@^`lDs!e6@8>n4x$l2Im!Bw@z>oKcKtA^b
z1>|Yn>bhXA>Ul66wK4C)dp8k}hkqQRJy58b71-r<<O`}+m_3J>%E~`&c(!rjO%|gt
zh05{xbVn^{JeaLsk9!}!^HUW^#vn<fae_!!ngMfYRHCu>#{$ggPY%)PcqMhkfdn%%
zTvlpJcN%KryPnKp#~vR(m^O;D9i6Jj4B}Cw7k3MdjGCFsw%uIL>HOc9;w0symnZ`z
z=hl%Hrx3;S8aQLT;}*<>+MotD-V!ttRmUa08#<ZacsJAqCY4br!`d8;xbkPhC}7NR
zLmx2mTIAjsd?^#87{etKp~k!JHa8<E^5j1`Cxt`JEJOs%o|dBj>H~=eGj-7+KVG4E
zaww-AgE<f?7a9dU9ghhE@$r{p8k|X2+Tr^%|6T~qp!X79je08#&uv5@42x=1#yl&n
zI}tB|NoJ--q^R3tHd3fTEiW;9y3x=)wqVg-mvK){%Cd479SU;q;pU%fBnakj3r&v$
zUy)vXUGQWKkPs!L#b}`bOccDx8&mzA;Svuytaw&=Fhap0R-ZmKksvkoA+5OMaiPKc
ziW>YZ0s0Rf!N9aldVi|D6&su_5<Cp&@sgxXMC<a8xpyJI=iJ&2T~%gyi1cML;+`WK
znFUq0g^W9(W8Me^;j^#lOt~Y<wL5C(;k+3?Twal2Mx*b$pR2+?vzZST``THc)r_y#
z{Uj!kf?D>`wON!WqbCD_Y_vbhhJYtiK@EP^@l1dOsgu1eAh!rUe=e5s%SMh<oe6Q?
zTm-YaYOddn_9^QmB;wg1iTqSIaBlMeClBQqt<bd3Mt<wzJQ}FwF_{R#{2dKuDqR24
zR`+?`Z;_K?H;dr>&0}$%ET_0VA+hx!*jKLMf?mWm`1vO$aKJp3{F7%cdrn=D`}YF=
zz1Z!7nvHxne3tBs*WnwwxqUP41oS<t*JglBII_AHWlC)YW|Rp5w3!zJN34_y8j_8)
zGkQpFe@uBY{`mBYoX~~7X{(v+79*V`vq#Opz5M`pJdl<0WSsG+yQ1pBI*}*ezb3B1
zKY2<5hwVoKB;uO&j9x9GZRKtG8G130M}gWjm<dm}CEPyb(Ws%hx@Sh~P}z4{Q|Bsi
z$!O|o${^mS?0uOKK=0A>tvAxn!{udQswWziXCIGUdJ_3TN!{L$=!b##3}Uuj1}|^n
zUcLhgYT2cW$xthX8ax*bDbABm6&n21qxIyA;4~kWw59|v0W*MiUoi?%rn$?YRO|tG
z!}2&H#Xm?u?0GZniULy_8fCY3tCbmpD2=o;Hi$=G)FJHC)2MbT@=>CxwcNcrhua>{
zW!Z!Gar;rrqRa2NgPp;*Lxihu`_C-OlTTcf$cb0FDztZY*SE~65tz-r@gn^wtfdmx
z5v$t=CKM@`+Rwpu4yc{Ewg64{!YFT+=WE)bJG&`BH!FEw-i4ui4t>q&p4)eJiEEDh
z5=N8;<kFw~^ZPS+{T)^40KNRM;mJ6~t#QNkqZ@8*F2mKKpa#bt;xIB;R$ba}Ooaik
z5Cb!qz8%7VPv~jpP*Pt+DCP25JGrKiRC||6FCpoK0lVDRw`Y#o*3d>WA%LFQquxTJ
zac_;}k+sUGM5=+}yRjTU=HNT&-q{84<9q8~xEj0JSt7!><ZzrBG_}z_EP*_E<#TbK
zj6?iST%--C@G%Hbvy4fX*zjOB`~CieZd*V#Kyu8R5jKiqU<KrS8_d5Jqt^x7)(phK
zDEKKa$BZ8Jxx2r-3}fZ*Y3mO4dDwoYERX<#*)Z`nfIh*K?|v$SyPp;z^g$m1A3P#~
zi%w02mIeE3;(FODBY_mdlTnL1p6sMJjDrc|wj9jmQ~-*AH@kz%$`Iv)nKbg?{%~KK
zXt!PL8hVGiZxsY*R(tE&lO{{(dpxB9o^9qFuG?1_O`^eU^z(zyXYjKJ@&b@Cm*NX&
zrLfc{1u34qT!gD%e4|J&j$NR5@|+pe*rW`Bpi&S0&vWfr0HSrhGCa<!gY9_8+ov93
z@WtojJgCPX-c=ze2pfz_<Y3+bx5a2{X$xsvKsOSTt1-RX?elr7+W65ub$IXvADnp3
z`6s4u-igc_rAR3rdnul9M0v6&96XL|J8S|}GzK{@g4t3F(|dCtgj8Dwm-Me)S|Vax
zmQWE?uxaA#kU)XUN8_eW_q-}WfH8fy?IRrtXeyy%QW#NF1H7}#|Jl)N@#XVUwIVB^
z&y~aK^(sF(7DzdpBpi9y48g&{h94+^ON~J(DlNiKz7I612H5u9T(}iQ!y5$K(<~5P
z863IYU8Q$M48O3UcvrA5O1bL%r_<$aG>{vk&^BJ?j+dlVO_+2zpefCuU9_VfxN+#d
zNG~dI3`tLY^{pHpdpVwPgbQ9`Fr`a_Ww54xWCRcQ@IsO8=mqD_Rael=?ga3Xkb*M(
z0=#k{fbfs6+guKs4;>|_(2@k^&NPE(0X%b<RvvJ6M5xSNF-2r7+y=Bwz7qNjRbh3y
z&V|;&mC2MoI?+-F76TN?lg~~i#V}nk8i>CT5y5o=D6@k6Wuz6KIwg@_3{&4T8&n$T
zS1(AcA?U6VcI^(NN;?NGxZwW$2T>pWLm(oM%Dd7(G`#j(wGKg_!(|^$;h=ebo=Wi&
zoVI_NyTYhW$b(b7_G$ra4>3mjruLAI1oQ!Oxik#l*_F#F2WU5LemMO6i$7AKKRG}^
z0QsJ$Gq_iHI&e`Q%83!cpE}irtMS~|A_+&HyDO@7)%jVjhbP6t%pUx~+eS@{{_$<Q
zVMMZBl>gVeGC6Aep!u$sC|pOQ&>W;m{PY&Jn=Vk@_PEaT2kt=LJ~DYYG?b5Q#=)pR
zxi^D%de!kTkb((E=2Ya;s3F6|d|yHhXf(CjCzqA5y*$y<F^`PS-@t?@bQO+PP_zH^
zz8t=FQ3^d>an7vpsrH~D7@PE8=SC~4q3@MEipDxufH$;yigL6@Ot;U8=bt9#V<hnB
zf?kB9t8vH^a%8inHlAWU9kIlG)Zjf;KjKKccG{4TYS6(oR!e(TIt_|O9yYc{Jh@px
zP5r?0TzGKIRqW*ol*hR0ie;EfJ_1WF<X=u)bi`FTMLAk49?^5#0^C1;pg2{)iH9ff
zxevQ=wb9_nlgkqGPd!=<tSxZg5Geq5NwyF`5c!VO;-7z4A2G#fBo7HU<#{Kj;az&y
zPB5!3DN-IIo;$8Ut=dW<7i1E6Ih>Iqg%>(oDf`X>xa?yUc>f}1vq)ciTe<9F2}h^u
zp;g@#>Ma0LbIjK(B7?aq;U<Fd>owos6(IgUEe10RQjb@K!F%|D>fOX<eyUc>wYT1-
zJ}j-Uq=V}^nJL$9`AHoPXkLtLd4dzkh%Wd8Dv&axM}gTS=08@Fn18{EYNmcar0(ie
zDDX#S<99ieC}~hC_o6uc?Yq4K%>OYwm~jrec{3RtJYQ*Z^hY<-0A76y1fczWiWDnw
z+R0-gU?yBj0a=bE^jCXvmOy(g8idmMZo9~*kq;loL@=eI11W004b;ewmGI<?PVqD6
zbRv#3>H=eq6qMg{l7v+1Wf1a{dmDopmxQ?Bq(lJO51e4_tJbM;i~S9TTE4lBgBqzr
z8WLCMrz!JYb-}#>eJu4L%xY!EJbkQlIiQ_na(FpPy3LOqm*{R$b;I{O6ORbmgrf?J
zxaO#K<ppnn(b$-Tl#`ZawL3uvZlO2hjcpJW)W`^AKZ{V`i{3i<NGANv3H;mgTrO50
zlkI!B-^d9-yU5&oECes;Fp1X8j59sz+dPnLC)WExUeJ`6qh(?{Lb}uO+joVl?xx>o
zlC#d8;h&1>p9mlsFyZBfTqC||u2ai`^LX(*6)=gr=5XHTKl?;QP>jL_yhe+7S}<Rw
z&fc>+UY7xS2xjA|qa91}TG}pAIUJgRFkdkP^>$2Aj@C)xhaoOJA$R;|4!1w9khbUm
z_udN$M?s?~Cc?8KXC~S@=Pn_s>>juEf}Er#CdiQy%spM<^Asb0#@qc7L8tCn4UL8S
zk5@^dG)n0`m-9nY;OY%M6PN}vn=%SpCxsuI`#@Z)(?D@;YWy*gC!fD0k?RZ6g1#o>
z9uRcJ0am%Efo0Bf0F+R}qY)V6y~Be!a((dy%O4>c>8o$WS`qk^1BLnPq{PbFZIbiK
zO=N|G9w-aGmxITzKT*>0Zae$Kg&@?&aSuiY&yop8%*)3p&<vugxp$2atz?rs-?KTy
z%%%15$6wB)Mj+A*bS0L7nE@T;r1sEg<3aP4M<Xf$<&h&&7!<rh1uzGj)-Yy_&<lUo
z)^?JPciYK-?Qg7o%)~mwpvZqaH;qoDsJyJ;TyvzJVz}D7q%A6Qp8Z1}=S3hde=`2d
zQ_ft_%=-Ky{c)wHbrp<<Vp&~}H+ehR@0B;kpSBGxn9VUD4OW(#WV4S>v?wnE{qEBR
z%s|75Uhv0^{q+71tTiD0rR66poIp=2%ybq2W%-l2oS-ojG)Bw7Y=bfs%oJNdo_83*
z5|uRYu9awJI?I&g9X5HxXlamsXXjTZqr%%nCPC<1NvI`Ja71{L6!-i5mIqolGyus#
z<|jbavmj^^00j*}q#L0i)xaF)!hPxMmrlaS{fKBI`NK0DHgD(B<8j^+2Jc&#6nYoB
zts4?oAmy4ogAJVMp(`xBZhM)8lLXM*{^RdUBa@njNkTqnE^1&`j1`Pdv&LWy%qTcM
zF(#LuWzt$*Z84D99)qlL=z)^ODF-Gg{oxsPZA`?v?^$$T=5Xfwl9KCK>Sa9_8rBN0
zdgf7HurG#fS9@I&=x}NDa+7dfi2~?DD+x;7S|ONox;{6d1Evnt&d<J91T;ng@z1}E
z;}Vp&S_;KWK-2`~n61Z6;y{I6{k&KQkmpeMqTZCguD%aOdoE_eFOhdT(K04LbDnR)
zPrAgy-jp&h<BPVVG0Z_myVub00#IFj`~tqlRAT3<bC~l4(?Mfyy0aD+IglNfNRzF+
z<8C9`5K6?%IbuYH!~q&M4oNwpt6o{3xTGau$IiAF=@@qn&Dc0zBBpiq_mm{y(Ea`o
zWVB&qaDdU0<hvy%TrZjl@oS^pzb4L|7cX@4<XOXyQ?e8E7-WN!eK_TBnGf1s&j;JC
zK8V+?X^ndy?l>#ZW;3ZjXN79oKsr9KVgU+Zfg<NkNg$$OdEnax|3s_GU9aoTbl=M6
zsxzlzuErbNiof&XLlaU?-%HE@WC2$t*FhjZ^gM@$UM$b$Ffy&XxQ{jp%9nWXGF|V(
z=`BdjtP+*fBTR+9$6GkKrF=b#Y<@TjULaj5`KcN6TM7X?md^9Q6A}P>-R8J4c*3D9
zxHOMY2u{0q?>g&+M*h{qxitEQ6B8Yc2?etcSI5ibm9<F-;XBiFN3$tEbc-dV5hyyu
zTX4-;bdxTX$Lpiok$eAg$m-ywiH1}F<+<02+8HzHjyMp!NMFIv95x^w=-4c@{qO!W
zAC_WJnLn!m&O9)a>zTc#HF=&Lliv*%>g}eTQ93_;)B~<Cgu;keR1-6;h>P5rH`?ZY
zWH2m)ziywP0XUaNC=2EXqtip00|C&vn)&qiPv>%2)kp-XMoc?X>J@7mbgda`S8)BV
z@VuOpS(By!-CB|JpJ>HvejsltU!p#Jo=P<~fYaJ>4X8>pIXwZL<(CHp8tZ-I-FO|-
zx?DNw@YRjU)6C2P9j7q+{WHV!<e1DZnRnX@^MijsVB?d9=0qC0H!rllak~aydq_tE
zI{bm8t1dD7w9&=D_aRfRU_Xi)D^&6rR<NE89@E}x&zsxgfX1Oz&d8$lhiGQ8@6|0J
zcyhfdo*a|VRTn%4c~al_HFsi+RYNiCxoQPjlU54mv&h>fRwjp+LrX%rvj&f^neksA
zL=e+NRvgd8KuVpC=r%MrI2QvdF~N*FLrsm&C$}m9oWrjk;v?e8F$rCDr9yzn^zbnT
zj0PpWicIRLd+P?*?W3JhCWn`UE6tqPtOL87h}A*lJYGUF==uxljC$RkLN6O^lxyhl
zEYoWsrFifKE-A)n=tU?oS6%TI^t&*_s&W$4=9Upzo@_NZNgsta1T#wKdpWe0tR!lO
z^W%b>P%+du-1~@Z^TK|URp-VEx&qDXROa2|gU{!1@6)XTGD;&?ofX2_z4Xw)Kn?RY
zc(5uKSX7U#M`^W8ib1k!!JE*P#+4@GKF6i!#kO6g1k7158&dQnb&0ak+-7JPeqd7m
zy{oe^(~D3Vy6WUjm<{4G)V?@spc2hY<}YB%R17ELC`pi-D47(LLk%r*o(f*jKt4}U
zjbIp;9r;qLQ$H<4HGI4lDold?-qkrg@k;9fQ0A(OiD#J7^~3dc9*#@_wWvK~0n6fA
zX|$0{ig`KAlEzA?wMN5o{yE{~FTQqnqO`Ls8)4#wXk-l3&u`2HPllG!i%@1yYXVrV
z%|poLjdr$g(atXFXo;ttjs4MP3kP+)hE9?q-z{vEXw(qQvGoAM^*@V#TvwalM0|O(
zWG;?YNF!HWC^4$V<MhdB=>lLCkeN!kYqPn)IyxU3Uu>FEqXw+zu<x1h#_(K!Khq1j
zJ29?0tC4w8Gy9s2!9*yl=3RAQpCJn7;&>FI%bi{zMq#}5PM~x&pc9!{X8^1eiKnlL
zW{!C-=y?UBk&~QfzdC!|)xyG^dsUip)d7%3r#?e%t=x4adEcz##vNzo)OplyGc`ho
z16od;LcSMVNG$TBk!`m#@Q`SXW@VAV0L;dJyJjPo6DsaaY06bc#50&lgSW@IOWrr0
z567$NaKq^76D}Rgp^-OM=|qNJzIkJf$%Bnp_bapNNEcl=*KVr<tAyv`)(1yF1OI4c
z&diZ2$;ddxf^Z60+rl}6m>t6U2iphJ9Sdl)8m$8yd8xdx2Po}h5X{U8MeNr|nA_z!
zxY{VW#O%6>05ejJ?$P{$9`6tKlNBhuW2}f}gZf?l?{O~&F8YHqma&MlrW*|tyvtZO
z3IJ}d3n*x&5X^E}i7epSA(*wGZ~4}T_CA<VnsU_<QM|YOo!f*i)8=zfc}k3t3_C`X
z^F)M}%O&W9%z-wLHeMRJF}+V2GzDfOd0FQg*<G(gDc~tx!R>pV&PSaYHx?O*tIh}=
z&l-Ol2F!XQbH-vFpJ6SMXy-1Ub~dzubR^~2e-4M<0f3!*ILw*uyXRtjmj^o<^$R@r
z2f)g*Hdf;*z%4WYpIA5gUM40z!Y(-DI3{OH#qIT50q%OD*aLWLjyEaVBp^aE{|HUf
z{$)!uh*79!P2$Qr#OQb}W32HT-MiA+ffc6xzB+^}CBmQWj=(#|BNk3Ai}UIb%qaIf
z-P#{=?o5EoKbG2gtnvB>%*E&;gB8#E*P7V_V-P>yNv8Ia$K>3A#dQcd=WYN1zVBM*
zrUh#k>FkMSTx3JLn97VnSDb$Ob*YamHa&r7Cppdd>Xz31m>!t9e~-9w7nPB^>a0X=
z*SILv7ndDs+;_%)phmU%7#ycC{#ay^jQS>Br}wLobWOUKh2@kW)yR1{;AwN&ybW5)
zoxgAv(aip33pX@!S6wJU!{?4#xl1u(0fGv;kOn=J;plhZ?G{|=_^H5vQ5T&1;gx1l
zzm!=~!6<YZR4_d+en`3zfVnskjQY2~h1zM!5eyETS8|YZITweKQM>AdbcN?}?*n|s
zOhel)(881+=e3$G(^k^48rpE(Qkp@3EY7Kg?t@u>psUW&jrcSL)Ogy~!ieCx?++IV
zBF`Wi<Br|VC>*J)j>`PmUb37o9<8vuKwE}PD+bA{u@{pQRkj_RCxeEDaxlAyVZ1OW
zUu#*UNbn<bVtlp=&WG<0mN$FX=k5m9zM=My##KjUpP5Dp6tCslI4{^Eo*P4e+NQu7
zp3+7#iDn-)iMfn`jt3f+oJ4<AZpI9%1I+$}WY7R7g<JR|9=EWpfv8>rm!Vs|UL75c
ztIo*L3z%Bct#}y+X7g;;dt^tP*`y`mcV<IojYq~fZ&}lBjZC5m&kcCX=t5Xte{wef
z*6!#2q%^#cW64{lqS23Ty)Wb+(=)7m&UGDQan&JDj|Pa$_n^V*sG)V;aXnjqmb>Y{
zrY4#h7byo=Of!4zLw^zeR7WigtuVj}!eh`vFbB70x6A<5r`P8~JFC5;cGZE>&ZaTM
zo<F<~g;Kgmkm{k(#@N0)V*=DN0Hr9t@OFszm!$21?Mc9)xwqvhn$nV57`p0Il-Hc(
zI3^FyrNC|-rnl@Mnwi}6mhJvxL!))oA&^l!ds6xUHvQQe(r8<Vzz**lWPDd2@WDZ`
zuclVcMS!EXBj&rGD48_V=?<rP;zpN0ak-LWIM}PE#gVZ`*XA;CGIzSWg~!%%Z#j#x
zxav+jR%vJN{RCxv%A=Yt(y*Fd?io1;=E4ltl!aj_8P_?|Z8TDL(#*?Yck%L~;TP$u
z%fbCX`XDD2HN(fpBIq&r>F;wm?hyROVD+oM-x+1JuDY`pGdOfVO(4ir1>Sss0hqCY
z59#aY+Ax-{IXClSs|rjEW<1`>SY&c6UO(JHnq@|QK$`PhJde&@5ot6n{3UnnK}~Hh
z?8#_cb+dXHoGHM3;CyiRPJ&6!0CXP+_Mss~!7PhriP)XXFa3k4iF2kK1Rtz%_HHl0
z?tV8xW(BGjiZYw(kgb6Ul1VX*f&E^_o4H@!&{f5s%j%%5fkU`=Z^?`ics7uh9Df*t
z<Ap2GL<POaA&){EHu7QQ#oTgeGuce8Q$&T<uICIX$C`~YkDYDa?yj3wwCgeBKf&`;
zsB9D}{l|I2@8SvH2zyaFeD+Zn(vG=?8&Q!g2y;8&2YDVmm@98DBYJL=zURaCXL9Lh
z+5o5~F5J833^fVn&=6K04)g8xtpE?b06;;E*V%tg0*ek*+j|Do--azYY~2Y9fhEfl
z4qxFpzcx>@TVXFrhiho+q3{lrg4t}EH3pS1h$L|Yc_L8Ia^o${xatm?$6(2k>a)zx
zT-G3mhIpZuB2Oz98G85y4$r-&jv;VQI4prro`yii#uIOBYc}L?%gS7wmoH?TU6*E+
zD<P?UHDl~K7-#ADrICv}Bl~QEz7nOKbtYa=kq=;AsItXQj)pR8dbxH+da>k428$0R
zy_6OMT-_#v1FGzx0JAcP-Ft9F89cEr7hqP46d{m5d0HxgTn1tzdj`}+PCYJxtvjT)
zMp+1Xb-8Gpx8^Lnc06gw<XSW+<jN%)3$?TBT*+9&$a#g6^>>r%IbPD;MQ8md`!!F-
z<>9)j#qPoYldf(6;J=fBK~C0*F<}(-9*`&BxhjX3H>>ifk^kb;DeOPD9LNab`<~|T
z_={32Lj$=a;prv3&aX|o*^RZVz6)9`lM2vQBk^)gn&ob4+(H0_Lt`JUS7v-&uX7{X
z8EFN&;$}{BHxp~L;Xnpj2J<j-^P;r7#`Hrw1;x1Ke)Wl3`SJ@=_~?>y&VxYy?PIz8
zGnyIY$b%ACun!JeNTd&ad#{?W<kii&oDg0ZoLA;UaB-4UuE<&a5on=wIG`PWw)8ea
zh3R(b#N|A!mlwh88I0q{JwjKVbi<vX08ORfQ`Wat*4qr$^s*Yf_!L`3#PXI0ln?yy
z0|5T|(rQDke8;01+<LzQGJ^Pcq0LVbhG|b%`FXDhQ2+A&Is$v4h}QfnVd)jEG#Wb`
z&<e)%$0?&307X|_83;nn=g#M)b+=NCr=q)}3_in?{d;kr!-AP<1F%krH32mR^SLJ`
z@Z}5BQm(vp2Zw*YEwj`DfqdQv6ZzSUV7b4!v<vQeGLwI3G$y>Vu~nLSY=CBLBfga_
z+Zq)a->$it$RITat@Z`CZ3Y){64DLN4I9dM0vcU)2;!5DC`tJQ|6a^SnP!%LW({Uz
z?8d;1M&Fk&EQiD&R%dY2-AXGXmAK@r3M^hUx^$rPKd7jT1a%JARl6z|w1QKQyM`WD
zK$p-49xtMd!QfZtq*NK03zr;6G#_^egNsg0VE(L<>&Nbo$IF-=OXe?g$NkMyQ!rn8
zPAdP(<d&70{6j$yUwU@hkXke&2<lfibEF{)^C9+C5s|qT#we2~Qpg)0M=fQRm9YC6
zE9EF<4P?B)j9!yZo|4Ffe+(s;Hl}c!mp5P(q#Ai%tOb3{zj@SY=0;$?;kLT)VyH?!
zb$TlJ{3!ESBZ740mETGK;n%8Z<ws-H(vxl_+1NIIvBscx-td|^){VCk(>R$78d9eo
z&15&8H0r^J;r`*fz(%ZcGt53kvCuX53+>G~_1MNV!+;s@?ThDCn&!&Q3f6~zLQBu)
zLvV@E(m#SR$RrxE65lp1yeyA*(aNkWPTr^wL^U95(Ly;NSj6D`lbB5n?XHw};d~f6
zCAYm?4Q{jMTv_$+LoX;W?>`6N8=oFtGb5P)^pC1?dFSzvGf$9!#=HBt_&NpX0^ovu
zL$zQ;N^o)k%n;$qoN9Lxavy~pwjaP*;zz_!b352b(#Wq7r9Qm;Ud@vX)#8l+r!IS9
zo${po&o5O=y%|4Qo=Gqxmq#$qn>l{A&=F4SpCM?+?6J^}$ro6GVmBNe(G8)Fb?P_<
zma?vWB!WB{10$%JIaR3$=15OoW&jrMg`~6KCgv^I>%~T@ax>KSmoKQ4`kB%A`|V?y
zq8aCp9n5z;T9*c-@oa>G5zz(vB=F|DIpp=)p)iJ=k4cjc9e$dPx}6=96~_k#TCHgS
z`6Y%G<jJQZPZodO-X!fVm!!L^7&M6qFWE_-p;n_!+cok3Smk`p=PrqJVbsdTn}Ke*
zvC@oHFXiySbIPDx^>QvKRtg_Frg-fI^FaU_pSyBAu<X4F=u%BdfGTJBA+$oB$HSs9
ztXm<tUb9mQ9D6W>3j|M|J-t|usjiwbf2!LeD=O@d(F|$)W@e;`KcCc^*8n!Yqj+<f
zM+1W<NHtJUn~v7UOy!=ZT=$3}@Oz)C!;uS$TEC~;4k|cASUfOVnOqz?0D}5)jlt)K
zv%?BvS~x69!_4z$C<=k2O=5D`{s3n$PGp|4s*`(lQ;JiqI4xR6i99d|G=n~XnKQ!`
zXM$>QnFfk-={e<8<8S}HE`uhhLCfgDNCdSrf|$yACsm>pCYFdb8tM3D-MrVu{QdPh
zorZuHz%mkkEP>2@!|>Cm6<;6H3)IM8JU5j_pD9c0=H_m=a?|0m&fbj`E*{zBMKISh
z{~k@FdG0mk)j0e>R!TLHW}t>fBd`@<#$+U_ol&sv7~N>4Ob(+k@`D#9E^i2mB96++
zm=HM%YTv)SD1oQfD{gwg90tc8qEb8!KW3pu4(e4YpoBs&e^hm;#)e|OLjiZjT6Pjc
z@UJh4|J(><!<$=S1fpO_JEon-TPB^C!)y%IDQAw93ASMvz`O4p^qM15=1f=A0)R(&
zEm*qaO)9BzhwCg>E5SvF19L<(qfqWlulvXg${<5Suo2ZjL04ice9fqxk#0~y%{<=P
z8D&yT)`$|)hFU$cpKO$IQo2tmOn*d(qzgKaxN!Xd%(k8am{o(QB$2w!{Q(pokUoID
zVKuN-4Jq><0+;MC!>7s&LG)_0l4_vb{z%cN8?J7n%{k9E!5F0T0Ui1A>okF%H!e>U
zqX#G>Ip+`#AhqSWuMJ%(J$gFS`UbfAKvx%dDV`RNVdEm7;b19qk802Y4IlwLsn>rg
z)6SG?ARQQMvJnbu<~6~n71aF0(HJ{<JZ5l?K_(aF(7(Kl3|gQ>{LiL*w366<?w#u!
zj^W4;2)5(e8>t41+<Vkz#{=aYTq*O`RCM{_>+~?HkDgfWb2i$!RdgU`2sV?<gh3S)
z(bx3C7)Aq4n(1`S=nYK9$-_Qh7cBUn1CT|vH>C?w=*wn)S$aucybg6XS1V4V(`SH^
zdYIi2UX#h?A)FRheCoN^!RBkk{K*JplR<a!*{#uQWrpBz+8I|v&?_SB8tcgL&ezb~
z2ZYS33xOKj*4T(?Mh9?CG(0bG?b!U&Wi&$_GZ2Jgs5=H`yF0ir&}R<PL-m1I-c%dt
zcaF*9Yn663*=}PMGz1@5<5P`hHNVl$;u*(0%|VB+g5~1?HFG_j-it#6E(;Cn<{n+)
zo*LEsn6t)UCfoFM6Xxdh{-_T<(jfiX9JuQtn8iJ#W;Ua?7cYuyM;zFSa^~U|Q4OJ;
z2ZA-fG2OHoS@W81=nTd@h1i5>XftLG=S6Fk;485+%Ln_t?U?qCP>(o|GeG3tC#|F5
zb-=mmIQYkTu)}KR2&!pzpdBYjZUjTzC?_n68-tWPw<5e<=BC4hqh<t0t)S$LFNZP8
zglOny0Nu>ctq_!EN#g=Yf)mQLcUZ>L&diKO<W>_#?;~~{tI^dwaHaR>)u%OaaGkIr
z<dHhoX}WRl2TF{=)e3yA3UvJI@9Kqp&AI@wF=)!Ms}%!f+jy<-<}6(Upm5UdM%}-=
z2>9T0$;sdX9L!eez#5?<4X#6t(QXn*p|L|B+#1ZhoOGCTc<vs?G&Vh3k(_rf6x7Ui
z#P)*LxamSe5W(DRw9#;VapP?;>bo68|Mo74zX&p>0a#GR0hr^OJGN#^18T#|fh}Ei
ziC?Cu(RrcOaiW{)bz(E;Bbaw-@5bQ=7B#ftt2iUlSVP<cL-Bl#kpyTS)P|(c8+Snq
zq$7>O8G7cR0o~If)yU0n9$<}5PoP|1U=xi1V$k$8s@oYW=MI^bvl`J4>8cCy8lfk&
zR=*iK%Q2)MW-@cktV3CJU}L(0lfsNuFwc1``5J_7Y;4tJGo1<OZuN;Hn(=kgFt`6B
zNA{6=EY09CK&fpD*6>{Jmk%332xc?})3l@kMYhzpvLj0D{B-30jX{W+b)n#Nw}x(%
zc|VLuD$!tZQJGEmq_3S9?88PBpt0vOXxVgNoj;8McD;E7OlF&+nHA4fAMT)Cs}Gz3
zh{HD-nexD=G`yf?W4sz&b%p#92*Aw!OgSeEJb3F>y7HVCkdAZ%<?sWFfL%joJDS!Y
z%#C2Z_5QldQN}1=j6#H9M)}hDBh${tGm=9#=J_~`bUcTqgF#U!Pzy#MgxkEtc+<1l
z)5sz(AEHIS^WeHDsGaFN&qYR4!b9{!6y1Y7PMH{!OGV&jZ07&xHmK4#kzyk;V8!Si
zZihpsaD;ZuO*axw?#^cqw{m*jjt;D-r4j;kM6@79o1+<YI<T-&5N&Mt#@%#5^_JIg
zvOi54xcJNlV<x9aUEfyakXtltndc3{S@(Bp4ZUB)|GZ&~I{SzN%YSy%;vra(C!@x`
z{?~P_y~kz<O6~lzHU<;kGVP4gu^Jk|Ohdko>-s<>459=~vFX4#$$54wM|l#fFVvd4
zOm|mV86Ig3^pioTjlDTU)Wex4lrpI2;)rSJ^>3*ch5#&++aE0-&xZ!w_kU5G|M}#j
z(-CWDWlXY%b5?8Vbh;g@p^-oK>cEV_g3(}9Q<?%6s8W1y0YFd>0Pr9)s8Dx_gkZ+S
zdy>QjR*V+5Um}{{T{#4^e+gr>(nocG_5o(rKtVaEB!U<7DGw*3(awg_h(OAf&|>LW
zK%?<P*XVXYQDV6)_+VDRq&k_FA(iP*PAG(R`-SI{G64QIy6SRH8-}@%bI(y~!6Of3
zI~iH8OCV9HCT_+XnJ1#BNuU#uqu}xoDD!5;H7WAtCthwi`+ihL8f_$=ja$cKX^M^o
zH2wfelY-XH?pQ2?4gd&eX3^k_I!tIw=!y&L3m5|hJPK0hBmpQe33KBySD!sZm(2h}
zv(*SNxu`t7X;X><+N&D+^!NEC)Brsimz<N1$nA!~nUR#o9svKuz3*zJXM;+|=R-FN
zkvobIB;Ql-h5pA<ioi7&(hMHEh}ooy7jQ%hi{6XAbMmSFSV%#*e|^qPS~QoB%@ln`
zh;wt_Wg5B}K^}a`*%kQq=c^K|!^uTwjF4*RsG?}-*NoS~K^+h1oHtnTM{7bJfP@~7
z0X5XbVHpk$0B`6(f)mKl^LPMeN;MP>Qm#R@=%w*`g#1P)N=f`CN@X)jJNBESJ~zAt
zo|ycOW(0x#Md4FMaF-d7BX!e}<o}KJv_7T@85_x@86->bLNUPUzl2yj`Vj}Srx}AX
z5Cc5(uUQG#Q`4NmeD}DrM|YG4E?$)0qXaS18J>98VSK;YYHR%#pAU~@MOq^WT3kK?
z=Y*!f9;qStz;l_S8Z5gQ#!)5*pt&;wt+p(vSp%HNct5ip)7HUutkD$C<<wQjeR2%0
zF*)6=m<}2HXsc(86%{;aswMPzO2!zVw%&J+0{G)={pUC70{ufJt)ziqv=C<?HGH|5
zVO2(uYTRL5feHWKcrTSaxh6a(YPG1DNq297#iR8AEl$7k=pny1;Got;VQ~fP$~y3}
zLLJDFncn2g`oY8N3ov7Th?!lrUT1tyf6mYl#WYb|(bXjIn?Q>myEkGn{QCS4@)3dA
z<w~<_@}xfQOC)#pRA5m)towf{%-dEPmO>p!xv-w$X-2_Op|>k3a|KHL%;>2wJ95i`
z5!}qbEC;=iJo&DTK&0DA!X<!T-^$^>XL7b`o${`r+;YF89cJVT^4QU6X(P>o8B<FU
z%y>O<#+odxjf+<!l#T{8^Zd;AAE1#m<KGICi0A||v005gjY)*^YP!#0m+7oJcaUZ?
zy9Q<{Qb8MYrX9@8&~Cj?QxI7rGr-@v17}B4(|x@v48eDL*~3}RzKneJIiaCZOB*ry
z(Qm#xdO$ZL6wE?4W-R*(>?N5TlQj|$26R=Ib4HmvPJdL|GKzdS{0@;YxcRj6JoBJ#
zunmoCHyhJj*=l;*m*|_*5ax!4Sid)yIV|k)mjM3oG=~>9a@f2bcJ<fz6<JcdxSrIO
z3vzuU7QNwiH3=ii;=|Mxo_}rR0hDINfLS-1jc5dpH*coW@uR-&hL;(qH&{3-+wo}b
z0hPx!G7mO6(Z*2RMr~S2I8fs+8kN)(L;01N(zuLyxm4B%&0VS#)-_ZEhO>#@{us`T
zl*4Op@m)Lm*)?f5oJN!6GgiA6yLtpO&RvI}ryZ*RjUI=w(2g=e&V1dkCl1UglVB<^
zLn$0rc67p_Ee>p=bqykEwX{t1+WuFh8nHN!qZ=My_VPuv#s;gG4GmF<m!$mdoeb`N
zio>dPT#l69wwpa%gX{tXZ){x>)z$M&7Suacp0o^eztmbS{pL2GW=sT_Q7ZKc&nk7+
zx`pTVsu(c4ZMhZr-+VAD{v4)a+P)vk!5r4(oyXjA6JY~zhMo$9s4}j%@M86fBs&MB
z*v3iKpL&He9F6kME)D~OuqIF7dwJ40Qw;%?=lSOnNUsy1J_A>^GX7``bew!l<3#^v
z1^vv{HOJV)NtJ&k%lMdAg&nC#ET=>0p&#8tah`2rkiwR2t?#~?x;_vy(5l*Ujp}gY
z*lbvym(YxGUw9rS@Fyg2;=+82QqX#QSEHsI+6V*^^&6^jhO>vhxCvmJ(0to>!!8UP
zk0jEDpw6KFxg<|75f`{>&j33F_oJ5n_j@woUmm^ZR^~>p%w)npig=D21%F?bjebRm
zG0C*SJgaogoH<nM>l-(J^!Tpz-JotwA!2U2GEj!64|~9p0@TioQ?G?OByr5FmxbJ!
zSET|mx-M|AuT;@5y~*TMxNq-3Y9VocW7^HH9qp25$gf$>9!a6{6>+_<;XVZ7zu!}b
zi_b|%q^Z&HyZgx;9(>LscOy^Wimb)C%_EgcrCzJR*0<|0a{*Hdtn~(TrfACHp^pSk
zcw^L-fxNT~C)F$E3o55V4}jG?7%2mt_l}t?B6YrDJPP=@2n;i}p8&AnxlajS@|)Xp
zct>mx)`c66=gT0iuYoaYKGfEAs4Ww~{;{ATSBjgv1P9H&@oQeXIu#Xc0GMKmMyZ+h
z3$-$<j=rI_Ql?ECs8#k`x?lgBtNLa`he`pnWg6Kl0|0c;D?Ny4%OiEfDpBT}<jyuh
z$W5bR2hf;fs<Sd$n>$~#_;1fZ4vz^p+?#?YzqL~YKL(Z78;&QBMl=n%LeP*$kcMpU
zg+p+N)jdx!IPxF{2hC698igom<l*0QuXBIyI;I<1GWLenD(N}?pux&7FJakf-`U;4
zhG8rw?2Z*EM~sS)(^(0x4y!hv3pH0Ao~6AMvMhDOSr;9-UByn2Uf|@CFTTOq3$LSg
z=CE_OoKp72q>KM(ytSTo^WAFrH3EB;^iq_1KsJg8zBQ@fz11dMBU9-S1|ecua_35Y
zMjt@mEa*51hx<3+zWSi`N&t9~X=kv-(^0KL_mL@h8{?s}$79qz2a+GFP_-+_V8d3<
zpIFD)HsQH=dza+Tw<cBiUM9e@Hw`NTY{=5Zq8WZTt)vHw)}|6s8QX}<L~zI-F>bi5
zO*Ar<0f}Lqob=Fi*z=J-=r};z`82Fn)!B61FQGT1G{oB<D`UW#^FpMNC5#KY!E(n(
z^vpDF;40V27qsHHcE|}|*lSyb!Pko(2llWaAJ^td{gDX;OPZ|_x4EW{8k*AS@wDq(
zBnv(S4$vUXgqc_Hf!)=<QDn_dpzv_B-1>_efXwH{4y<6Qf#JAbN*tJ|ATE5WTyD&S
zvl$I*bC<Xw{`L$4JiCFz%WnuboN#&V>JvO!0eRfB&?d7~r%&%gx`Er)T{rs-LElzE
zX8{@@@NmS8#Mnv2a}AqdE^V3`j+_KLz~o|dcUkaC-b|B<fDC5Esmjoo{NhF~qIDrp
z&f1ELcB1TeJoK7v+p!?R2iV{q=pZQ=YP@kdn!iC0Ql3ms;mX_LaxB0MjRG|_0m-T(
z(R4=B>tK`cTHN^rhsW0D!tKT3-Cn-DQMh_aMkdn)W{q}6@d7GOOq<vHv7tRZ10Ck^
zC}?T@Pn0u5KrOs_EOBAxe>z?dNxC)~+4L^y-ZNor%a^&1CB3zs!?Uje6nJu)O=$38
zG6{M%<}I1Go9^>H>4Hml^={q)9V|sK2dSavACGPrLsIb#Gclvn+$w3vctC`9=9LP7
z9>~hwpjO6_UOe$Kj&Q~_O%9vhhFt@L!gG<-E^fsP^;6;mu}ZZwN+INZ=M6^>F8%YZ
zyJ|CMw0*F}@Lu}e^GkyQD+Ii{$V`|isU){`NzRey7VT1`F{q73+{(41T7;_Ei^9Q$
z+8Gmya=^6C@%JacH>Ix^u^R4;#yVI0%l^CZ1ZZ~&!K@MPQ3}Uxt!8E{@JMrVTy8R@
zb&YR>`AWT~TWNB2IWBXJZ-0!#<1gi~?hTdJS?Ag5Q#^URq_6j(f7maI&(h$%I-$)$
z&8Sw6kNkI9ncGj9Yr(+_R|m6v>bwgzK2;NASs+ba4}h~1{eCrv<*NW*5<q_A9oRU;
z;d4kYCL$O3y&>gbMroLh(h;Br16D#aI5bEDWfq+BlW6du7Mf_S3SizwMY-XgS<m6u
z4|BO@$@;hWuKpUkCQIw5Px0jOl*V928Fs`9R*=`WZAXg|+D*9o^Zd`$4%EkJKs)!c
z;s7`gV_{53xz(UmEQUN9Cw6&d3&3w4<#K%y5xRz*eVEn>ry;$7DH#_@hJerRfAihp
zz>LyV9`qyEE$qMeRzCFh^DwK{*Eb!;AUL7+Ki$^aSSpX~pj1O8(380Uq*uZXAEDC-
zXx_|xPYGvlyvsp=nPFhWq;;w&U+s~0$u^selGo}3=g*zJW7)E!n;J9LbYj1DkL>uw
zH(u`V?>b;sEls;%1hQ2)1OMqZ4$o|;3hTc$Zf;5uNY0Rn@fjxs=h}a45|P1ZWahN9
zoBP5=|4?@I<*@QO%mv1|>Nrm7vXP|>-Ed=G^>j+grJ7|!(}v!Xo{W)jxDk(3(XNs~
z0qpMD^rI?6^&!~ZV5ZByK@PX91o+vCR03ImW|zRsBSJx52rUt9q#0X{lMGOmV8L8g
zy)y4?@;wI&TyFeydSjr*;i*@}-z#boalG#uH{t5`N}Zf6g4CkBd$6zC_wGQ<CD)9M
zdgztD;OpmHHLziKKU=i=l^m8F=~MDwK9Ir9%eer&QszwMFI-!%<#QNMFC5KS#PwUu
zYEFr!7G{oFF!@GOIJZc*!>4W5oAzKZFRl$>mUvk6I%kir<#t6Wz{$B;c5Tl1#&%4d
z>{LMjr)gHhp;HLr)Al*4wrtsqF%3r_^H@SbO@Ar?^1bi>B7@6>&OPZ!2CLU`xN}tw
z2yzqw<P{vUznea|=^+r!U{BA&Ltz*!hhq`ZMfQu8Io$qeMNn3E+bTNk=Fc+VWjX;l
z_YiBw{i(Q~nN`Us?M?3rd*Q{LZF&d1`<{XKJtZxXt%FD9vlgu2OJQlg>>rp1-aBFJ
z(h}?JoU4YO5{Ot5IkZ9O(JNM5)BPK|bLqGG7v*WP{=j(*ZuxFCT4%kUL4UtmMCA?<
zwD|do1bPQ5MjvB%e(oQAh`|YmF&84SBT>98BTmD9RJ1Qz7<eL>^el(xU$=*L2&Qty
z1J`!l3{%ok(vs2ME3fG~Y3Y^ym+>V1l0e8Jv1_%^j4RW;`{otbvr*@UU~<oo?_$Ec
zP*sFjXw0NObVZ(4za<WT3ClP)vh^*?P&K1T_GB(NPDYXp);NFS70wJ#25cxS|3Omk
zxqdA7JtY$-t@WRcK+e8uaJ%@J`@6rZ!pv#@Z6LS){w;NQ`jy;h<P8bSFJJMG(^lwn
zZx$b4`Y&2TYkur`Clo#Ab|kje;M@QjCv92&q~pohSXe!~e8u(CHo%m0tW4Pa&;mfK
z1-O>pa9al7{=B-4-Thn`k~#e9{#<)bSYwSzTy@%GVb}-LL2fq;N^LNlCg46nF9=Uw
z%^<tNG?pppY?(Mf3vI~L<f*$><#Qi=t|qj!(9GK%%M}#iW|md27_RGA$rfPU&c-S<
z^In+BaB`GKUgYrPEB4eK!bZIM{(tPg9;Rf{$b<nJyLMq5p2REZO+p(l-K~}#+o3h)
z)r~bK-+?F{ki6GA?uaO5Z6bikkslUdHj7e<bAFIy-OHwU^5l~VU6Mlc)pM7Ai_aCI
z4Dr{qqbZOvQHC2su3!e3lp^VVyK9Okzo(=v)>zRXZdzONoTDa(oqe7m$c$l#07f8h
ze8-;R8I@Bqd8H#44MKNdo(^62@|&D}_<ae?nx@=zsIi}TS<wqE(x|-uAEzyYDS1!G
zgt_g;Dra9cAdEToP24`}Ahi!Q@)S>gZ%fAl8ij(|h~&w`8kJKrS*4=^je=oxNRuUy
k<a43c^P4G+{N9%T4`b2f(dL>7cmMzZ07*qoM6N<$f<)dE1ONa4

literal 0
HcmV?d00001


From fffa48535e8a53f8d8e6b3a03eda5014cb856f92 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Tue, 31 Mar 2026 11:30:44 +0200
Subject: [PATCH 08/29] proper icons for settings certs sections

---
 .../tabs/SettingsCertificatesTab/SettingsCertificatesTab.tsx  | 4 ++--
 web/src/shared/defguard-ui                                    | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/web/src/pages/settings/SettingsIndexPage/tabs/SettingsCertificatesTab/SettingsCertificatesTab.tsx b/web/src/pages/settings/SettingsIndexPage/tabs/SettingsCertificatesTab/SettingsCertificatesTab.tsx
index 078810e016..31462fc16f 100644
--- a/web/src/pages/settings/SettingsIndexPage/tabs/SettingsCertificatesTab/SettingsCertificatesTab.tsx
+++ b/web/src/pages/settings/SettingsIndexPage/tabs/SettingsCertificatesTab/SettingsCertificatesTab.tsx
@@ -10,7 +10,7 @@ export const SettingsCertificatesTab = () => {
     <SettingsLayout id="certificates-settings">
       <Link to="/settings/ca">
         <SectionSelect
-          image="customization"
+          image="certificate-authority"
           title={m.settings_certs_ca_title()}
           content={m.settings_certs_ca_description()}
         />
@@ -18,7 +18,7 @@ export const SettingsCertificatesTab = () => {
       <SizedBox height={ThemeSpacing.Xl} />
       <Link to="/settings/certs">
         <SectionSelect
-          image="customization"
+          image="certificates"
           title={m.settings_certs_certs_title()}
           content={m.settings_certs_certs_description()}
         />
diff --git a/web/src/shared/defguard-ui b/web/src/shared/defguard-ui
index c89f17d025..2f6adff5bc 160000
--- a/web/src/shared/defguard-ui
+++ b/web/src/shared/defguard-ui
@@ -1 +1 @@
-Subproject commit c89f17d025214b4bf35e083bf81a72785e1d0098
+Subproject commit 2f6adff5bcedbb36a151635f5de87d026489be8f

From d6ad6eb26442063c33406d30654dd959054037a7 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Wed, 1 Apr 2026 10:41:14 +0200
Subject: [PATCH 09/29] fix firewall test import

---
 crates/defguard_core/src/enterprise/firewall/tests/mod.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/crates/defguard_core/src/enterprise/firewall/tests/mod.rs b/crates/defguard_core/src/enterprise/firewall/tests/mod.rs
index 7047773d5d..e9295bc11b 100644
--- a/crates/defguard_core/src/enterprise/firewall/tests/mod.rs
+++ b/crates/defguard_core/src/enterprise/firewall/tests/mod.rs
@@ -27,7 +27,7 @@ use crate::enterprise::{
         AclRuleInfo, AclRuleNetwork, AclRuleUser, AliasKind, PortRange, RuleState,
     },
     firewall::try_get_location_firewall_config,
-    license::{License, LicenseTier, set_cached_license},
+    license::{License, LicenseTier, SupportType, set_cached_license},
 };
 
 mod all_locations;
@@ -55,7 +55,7 @@ fn set_test_license_business() {
         customer_id: "0c4dcb5400544d47ad8617fcdf2704cb".into(),
         limits: None,
         subscription: false,
-        support_type: crate::enterprise::license::SupportType::Basic,
+        support_type: SupportType::Basic,
         tier: LicenseTier::Business,
         valid_until: None,
         version_date_limit: None,

From 3267007799580747bbd51108b8a6235ddc829b57 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Wed, 1 Apr 2026 11:12:01 +0200
Subject: [PATCH 10/29] fix icons

---
 web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx        | 2 +-
 .../SettingsCertificatesPage/SettingsCertificatesPage.tsx       | 2 +-
 web/src/shared/defguard-ui                                      | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx b/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
index 5cfccde717..38e0015ad9 100644
--- a/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
+++ b/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
@@ -42,7 +42,7 @@ export const SettingsCaPage = () => {
       <Breadcrumbs links={breadcrumbs} />
       <SettingsLayout>
         <SettingsHeader
-          icon="customize"
+          icon="aliases"
           title={m.settings_certs_ca_title()}
           subtitle={m.settings_certs_ca_description()}
         />
diff --git a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
index 2cf6dd7707..804dba16a4 100644
--- a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
+++ b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
@@ -29,7 +29,7 @@ export const SettingsCertificatesPage = () => {
       <Breadcrumbs links={breadcrumbs} />
       <SettingsLayout>
         <SettingsHeader
-          icon="customize"
+          icon="aliases"
           title={m.settings_certs_certs_title()}
           subtitle={m.settings_certs_certs_description()}
         />
diff --git a/web/src/shared/defguard-ui b/web/src/shared/defguard-ui
index 377cc8bd7c..c268db02f3 160000
--- a/web/src/shared/defguard-ui
+++ b/web/src/shared/defguard-ui
@@ -1 +1 @@
-Subproject commit 377cc8bd7cbc0a5b8acf996da523ed0aa7535221
+Subproject commit c268db02f379e38ba8ffd77fa3c9e430b42abc24

From 8b06467c4cfe59eef728eb3d8672b1f2779a6659 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Wed, 1 Apr 2026 11:38:22 +0200
Subject: [PATCH 11/29] bootstrap certs sections

---
 web/messages/en/settings.json                 |  2 ++
 .../SettingsCertificatesPage.tsx              | 22 +++++++++++++++++--
 web/src/shared/defguard-ui                    |  2 +-
 3 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/web/messages/en/settings.json b/web/messages/en/settings.json
index b150ea95a0..a16e9838c0 100644
--- a/web/messages/en/settings.json
+++ b/web/messages/en/settings.json
@@ -39,6 +39,8 @@
   "settings_certs_ca_valid_until": "Valid until",
   "settings_certs_certs_title": "Edge/Core Certificates",
   "settings_certs_certs_description": "Add and manage certificates issued outside of Defguard. Use them to integrate existing infrastructure and maintain secure connections with external systems and services.",
+  "settings_certs_certs_core_title": "Core certificate",
+  "settings_certs_certs_core_description": "Manage certificates automatically generated by Defguard for secure communication.",
   "settings_vpn_stats_toggle_title": "Stats purge",
   "settings_vpn_stats_label_purge_frequency": "Stats purge frequency",
   "settings_vpn_stats_helper_purge_frequency": "",
diff --git a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
index 804dba16a4..60ece34375 100644
--- a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
+++ b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
@@ -7,6 +7,9 @@ import { SettingsHeader } from '../../../shared/components/SettingsHeader/Settin
 import { SettingsLayout } from '../../../shared/components/SettingsLayout/SettingsLayout';
 import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { ThemeSpacing } from '../../../shared/defguard-ui/types';
+import { MarkedSection } from '../../../shared/defguard-ui/components/MarkedSection/MarkedSection';
+import { MarkedSectionHeader } from '../../../shared/defguard-ui/components/MarkedSectionHeader/MarkedSectionHeader';
+import { Divider } from '../../../shared/defguard-ui/components/Divider/Divider';
 
 const breadcrumbs = [
   <Link
@@ -34,7 +37,6 @@ export const SettingsCertificatesPage = () => {
           subtitle={m.settings_certs_certs_description()}
         />
         <SettingsCard>
-          <SizedBox height={ThemeSpacing.Xl2} />
           <Content />
         </SettingsCard>
       </SettingsLayout>
@@ -43,5 +45,21 @@ export const SettingsCertificatesPage = () => {
 };
 
 const Content = () => {
-  return <div>TODO</div>;
+  return (
+    <>
+      <MarkedSection icon="authorised-app">
+        <MarkedSectionHeader
+          title={m.settings_certs_certs_core_title()}
+          description=''
+        />
+      </MarkedSection>
+      <Divider spacing={ThemeSpacing.Xl2} />
+      <MarkedSection icon="globe">
+        <MarkedSectionHeader
+          title={m.settings_instance_section_core()}
+          description=''
+        />
+      </MarkedSection>
+    </>
+  );
 };
diff --git a/web/src/shared/defguard-ui b/web/src/shared/defguard-ui
index c268db02f3..ecf74e0fb8 160000
--- a/web/src/shared/defguard-ui
+++ b/web/src/shared/defguard-ui
@@ -1 +1 @@
-Subproject commit c268db02f379e38ba8ffd77fa3c9e430b42abc24
+Subproject commit ecf74e0fb88a7a8e48d681cb25abf7d11820c8cd

From 07394f2ed2292c129c77ba41ea89c3648c72af25 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Thu, 2 Apr 2026 09:46:23 +0200
Subject: [PATCH 12/29] get_certs API endpoint, None and SelfSigned core certs
 sections

---
 .../defguard_core/src/handlers/core_certs.rs  | 56 +++++++++++----
 crates/defguard_core/src/lib.rs               |  3 +-
 web/messages/en/settings.json                 |  6 +-
 .../SettingsCaPage/SettingsCaPage.tsx         |  7 +-
 .../SettingsCertificatesPage.tsx              | 68 ++++++++++++++++---
 web/src/shared/api/api.ts                     |  2 +
 web/src/shared/api/types.ts                   | 23 +++++++
 web/src/shared/defguard-ui                    |  2 +-
 8 files changed, 137 insertions(+), 30 deletions(-)

diff --git a/crates/defguard_core/src/handlers/core_certs.rs b/crates/defguard_core/src/handlers/core_certs.rs
index 80d002b9a4..ef72dd17c6 100644
--- a/crates/defguard_core/src/handlers/core_certs.rs
+++ b/crates/defguard_core/src/handlers/core_certs.rs
@@ -1,7 +1,9 @@
 use axum::{Extension, Json, extract::State, http::StatusCode};
-use serde_json::json;
-use defguard_certs::{CertificateAuthority, CertificateInfo, Csr, DnType, der_to_pem, generate_key_pair};
+use defguard_certs::{
+    CertificateAuthority, CertificateInfo, Csr, DnType, der_to_pem, generate_key_pair,
+};
 use defguard_common::db::models::{Certificates, CoreCertSource};
+use serde_json::json;
 use sqlx::PgPool;
 use utoipa::ToSchema;
 
@@ -175,10 +177,7 @@ pub(crate) async fn core_cert_self_signed(
     ),
     security(("cookie" = []), ("api_token" = []))
 )]
-pub(crate) async fn get_ca(
-    _role: AdminRole,
-	Extension(pool): Extension<PgPool>,
-) -> ApiResult {
+pub(crate) async fn get_ca(_role: AdminRole, Extension(pool): Extension<PgPool>) -> ApiResult {
     debug!("Fetching certificate authority details");
     let certs = Certificates::get_or_default(&pool)
         .await
@@ -195,14 +194,14 @@ pub(crate) async fn get_ca(
 
         Ok(ApiResponse::new(
             json!({
-				"ca_cert_pem": ca_pem,
-				"subject_common_name": info.subject_common_name,
-				"not_before": info.not_before,
-				"not_after": info.not_after,
-				"valid_for_days": valid_for_days,
-				"ca_expiry": certs.ca_expiry,
-				"subject_email": info.subject_email,
-			}),
+                "ca_cert_pem": ca_pem,
+                "subject_common_name": info.subject_common_name,
+                "not_before": info.not_before,
+                "not_after": info.not_after,
+                "valid_for_days": valid_for_days,
+                "ca_expiry": certs.ca_expiry,
+                "subject_email": info.subject_email,
+            }),
             StatusCode::OK,
         ))
     } else {
@@ -211,3 +210,32 @@ pub(crate) async fn get_ca(
         ))
     }
 }
+
+#[utoipa::path(
+    post,
+    path = "/api/v1/core/cert/certs",
+    responses(
+        (status = 200, description = "Core & edge cert data", body = ApiResponse),
+        (status = 400, description = "Invalid request (e.g. CA not configured).", body = ApiResponse),
+        (status = 401, description = "Unauthorized.", body = ApiResponse),
+        (status = 403, description = "Forbidden.", body = ApiResponse),
+        (status = 500, description = "Internal server error.", body = ApiResponse)
+    ),
+    security(("cookie" = []), ("api_token" = []))
+)]
+pub(crate) async fn get_certs(_role: AdminRole, Extension(pool): Extension<PgPool>) -> ApiResult {
+    debug!("Fetching certificate authority details");
+    let certs = Certificates::get_or_default(&pool)
+        .await
+        .map_err(WebError::from)?;
+    Ok(ApiResponse::new(
+		json!({
+			"core_http_cert_pem": certs.core_http_cert_pem,
+			"core_http_cert_source": certs.core_http_cert_source,
+			"core_http_cert_expiry": certs.core_http_cert_expiry,
+			"proxy_http_cert_source": certs.proxy_http_cert_source,
+			"proxy_http_cert_expiry": certs.proxy_http_cert_expiry,
+		}),
+		StatusCode::OK
+	))
+}
diff --git a/crates/defguard_core/src/lib.rs b/crates/defguard_core/src/lib.rs
index 382780cf40..68bd271900 100644
--- a/crates/defguard_core/src/lib.rs
+++ b/crates/defguard_core/src/lib.rs
@@ -117,7 +117,7 @@ use crate::{
             webauthn_start,
         },
         component_setup::setup_gateway_tls_stream,
-        core_certs::{core_cert_self_signed, core_cert_upload, get_ca},
+        core_certs::{core_cert_self_signed, core_cert_upload, get_ca, get_certs},
         forward_auth::forward_auth,
         gateway::{delete_gateway, gateway_details, gateway_list, update_gateway},
         group::{
@@ -386,6 +386,7 @@ pub fn build_webapp(
             .route("/core/cert/upload", post(core_cert_upload))
             .route("/core/cert/self-signed", post(core_cert_self_signed))
 			.route("/core/cert/ca", get(get_ca))
+			.route("/core/cert/certs", get(get_certs))
             // Gateway routes
             .route("/gateway", get(gateway_list))
             .route(
diff --git a/web/messages/en/settings.json b/web/messages/en/settings.json
index a16e9838c0..59f222d534 100644
--- a/web/messages/en/settings.json
+++ b/web/messages/en/settings.json
@@ -40,7 +40,11 @@
   "settings_certs_certs_title": "Edge/Core Certificates",
   "settings_certs_certs_description": "Add and manage certificates issued outside of Defguard. Use them to integrate existing infrastructure and maintain secure connections with external systems and services.",
   "settings_certs_certs_core_title": "Core certificate",
-  "settings_certs_certs_core_description": "Manage certificates automatically generated by Defguard for secure communication.",
+  "settings_certs_certs_core_none_title": "No SSL certificate",
+  "settings_certs_certs_core_none_description": "You have opted to deploy a custom Reverse Proxy and manage your own SSL certificates. ",
+  "settings_certs_certs_core_none_add_certificate": "Add certificate",
+  "settings_certs_certs_core_internal_title": "Defguard Internal CA",
+  "settings_certs_certs_core_internal_description": "Manage certificates automatically generated by Defguard for secure communication.",
   "settings_vpn_stats_toggle_title": "Stats purge",
   "settings_vpn_stats_label_purge_frequency": "Stats purge frequency",
   "settings_vpn_stats_helper_purge_frequency": "",
diff --git a/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx b/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
index 38e0015ad9..813724f177 100644
--- a/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
+++ b/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
@@ -17,9 +17,9 @@ import { Divider } from '../../../shared/defguard-ui/components/Divider/Divider'
 import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { ThemeSpacing } from '../../../shared/defguard-ui/types';
 import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
+import { displayDate } from '../../../shared/utils/displayDate';
 import { downloadFile } from '../../../shared/utils/download';
 import caIconSrc from './assets/ca.png';
-import { displayDate } from '../../../shared/utils/displayDate';
 
 const breadcrumbs = [
   <Link
@@ -73,6 +73,7 @@ const Content = () => {
     });
     downloadFile(blob, 'defguard-ca', 'pem');
   }, [caData?.ca_cert_pem]);
+
   return (
     <ActionableSection
       variant={ActionableSectionVariant.Secondary}
@@ -87,7 +88,9 @@ const Content = () => {
         <div className="ca-info-label">{m.settings_certs_ca_email()}</div>
         <div className="ca-info-value">{caData?.subject_email}</div>
         <div className="ca-info-label">{m.settings_certs_ca_valid_until()}</div>
-        <div className="ca-info-value">{caData?.ca_expiry ? displayDate(caData?.ca_expiry) : '-'}</div>
+        <div className="ca-info-value">
+          {caData?.ca_expiry ? displayDate(caData?.ca_expiry) : '-'}
+        </div>
       </div>
       <Divider spacing={ThemeSpacing.Md} />
       <SizedBox height={ThemeSpacing.Xl2} />
diff --git a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
index 60ece34375..71ee6efef8 100644
--- a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
+++ b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
@@ -1,15 +1,22 @@
+import { useQuery } from '@tanstack/react-query';
 import { Link } from '@tanstack/react-router';
+import { useCallback } from 'react';
 import { m } from '../../../paraglide/messages';
+import api from '../../../shared/api/api';
 import { Breadcrumbs } from '../../../shared/components/Breadcrumbs/Breadcrumbs';
+import { DescriptionBlock } from '../../../shared/components/DescriptionBlock/DescriptionBlock';
 import { Page } from '../../../shared/components/Page/Page';
 import { SettingsCard } from '../../../shared/components/SettingsCard/SettingsCard';
 import { SettingsHeader } from '../../../shared/components/SettingsHeader/SettingsHeader';
 import { SettingsLayout } from '../../../shared/components/SettingsLayout/SettingsLayout';
-import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
-import { ThemeSpacing } from '../../../shared/defguard-ui/types';
+import { Button } from '../../../shared/defguard-ui/components/Button/Button';
+import { Divider } from '../../../shared/defguard-ui/components/Divider/Divider';
 import { MarkedSection } from '../../../shared/defguard-ui/components/MarkedSection/MarkedSection';
 import { MarkedSectionHeader } from '../../../shared/defguard-ui/components/MarkedSectionHeader/MarkedSectionHeader';
-import { Divider } from '../../../shared/defguard-ui/components/Divider/Divider';
+import { ThemeSpacing } from '../../../shared/defguard-ui/types';
+import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
+import { downloadFile } from '../../../shared/utils/download';
+import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
 
 const breadcrumbs = [
   <Link
@@ -45,20 +52,59 @@ export const SettingsCertificatesPage = () => {
 };
 
 const Content = () => {
+  const { data: certsData, isFetching } = useQuery({
+    queryKey: ['core', 'cert', 'certs'],
+    queryFn: api.core.getCerts,
+    select: (resp) => resp.data,
+  });
+
+  const handleDownloadCA = useCallback(() => {
+    const corePem = certsData?.core_http_cert_pem;
+    if (!isPresent(corePem)) return;
+    const blob = new Blob([corePem], {
+      type: 'application/x-pem-file;charset=utf-8',
+    });
+    downloadFile(blob, 'defguard-core', 'pem');
+  }, [certsData?.core_http_cert_pem]);
+
   return (
     <>
       <MarkedSection icon="authorised-app">
-        <MarkedSectionHeader
-          title={m.settings_certs_certs_core_title()}
-          description=''
-        />
+        <MarkedSectionHeader title={m.settings_certs_certs_core_title()} />
+        {certsData?.core_http_cert_source === 'None' && (
+          <>
+            <DescriptionBlock title={m.settings_certs_certs_core_none_title()}>
+              <p>{m.settings_certs_certs_core_none_description()}</p>
+            </DescriptionBlock>
+            <SizedBox height={ThemeSpacing.Lg} />
+            <Button
+              variant="primary"
+              text={m.settings_certs_certs_core_none_add_certificate()}
+              onClick={handleDownloadCA}
+              loading={false}
+              disabled={false}
+            />
+          </>
+        )}
+        {certsData?.core_http_cert_source === 'SelfSigned' && (
+          <>
+            <DescriptionBlock title={m.settings_certs_certs_core_internal_title()}>
+              <p>{m.settings_certs_certs_core_internal_description()}</p>
+            </DescriptionBlock>
+            <Button
+              variant="outlined"
+              iconLeft="download"
+              text={m.settings_certs_ca_download()}
+              onClick={handleDownloadCA}
+              loading={isFetching}
+              disabled={!isPresent(certsData?.core_http_cert_pem) || isFetching}
+            />
+          </>
+        )}
       </MarkedSection>
       <Divider spacing={ThemeSpacing.Xl2} />
       <MarkedSection icon="globe">
-        <MarkedSectionHeader
-          title={m.settings_instance_section_core()}
-          description=''
-        />
+        <MarkedSectionHeader title={m.settings_instance_section_core()} />
       </MarkedSection>
     </>
   );
diff --git a/web/src/shared/api/api.ts b/web/src/shared/api/api.ts
index 57152a0432..4e7c5a5b86 100644
--- a/web/src/shared/api/api.ts
+++ b/web/src/shared/api/api.ts
@@ -59,6 +59,7 @@ import type {
   Gateway,
   GatewayInfo,
   GetCAResponse,
+  GetCertsResponse,
   GetExternalSslInfoResponse,
   GetInternalSslInfoResponse,
   GroupInfo,
@@ -470,6 +471,7 @@ const api = {
     certUpload: (data: { cert_pem: string; key_pem: string }) =>
       client.post('/core/cert/upload', data),
     getCA: () => client.get<GetCAResponse>('/core/cert/ca'),
+    getCerts: () => client.get<GetCertsResponse>('/core/cert/certs'),
   },
   acl: {
     destination: {
diff --git a/web/src/shared/api/types.ts b/web/src/shared/api/types.ts
index 3f6ddca8b0..46fba6b2a5 100644
--- a/web/src/shared/api/types.ts
+++ b/web/src/shared/api/types.ts
@@ -53,6 +53,29 @@ export interface GetCAResponse {
   subject_email: string | null;
 }
 
+export const CoreCertSource = {
+  None: 'None',
+  SelfSigned: 'SelfSigned',
+  Custom: 'Custom',
+} as const;
+export type CoreCertSourceValue = (typeof CoreCertSource)[keyof typeof CoreCertSource];
+
+export const EdgeCertSource = {
+  None: 'None',
+  SelfSigned: 'SelfSigned',
+  LetsEncrypt: 'LetsEncrypt',
+  Custom: 'Custom',
+} as const;
+export type EdgeCertSourceValue = (typeof EdgeCertSource)[keyof typeof EdgeCertSource];
+
+export interface GetCertsResponse {
+  core_http_cert_pem: string;
+  core_http_cert_source: CoreCertSourceValue;
+  core_http_cert_expiry: string;
+  proxy_http_cert_source: EdgeCertSourceValue;
+  proxy_http_cert_expiry: string;
+}
+
 export interface UploadCARequest {
   cert_file: string;
 }
diff --git a/web/src/shared/defguard-ui b/web/src/shared/defguard-ui
index ecf74e0fb8..35a6990f34 160000
--- a/web/src/shared/defguard-ui
+++ b/web/src/shared/defguard-ui
@@ -1 +1 @@
-Subproject commit ecf74e0fb88a7a8e48d681cb25abf7d11820c8cd
+Subproject commit 35a6990f34af12b075437838eefcc31e5707295a

From 5ab6ea91c6846a19ba5888ec930087f9de14d899 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Thu, 2 Apr 2026 10:00:33 +0200
Subject: [PATCH 13/29] core own cert

---
 web/messages/en/settings.json                 |  3 +++
 .../SettingsCertificatesPage.tsx              | 19 +++++++++++++++++--
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/web/messages/en/settings.json b/web/messages/en/settings.json
index 59f222d534..5b7a0a228a 100644
--- a/web/messages/en/settings.json
+++ b/web/messages/en/settings.json
@@ -45,6 +45,9 @@
   "settings_certs_certs_core_none_add_certificate": "Add certificate",
   "settings_certs_certs_core_internal_title": "Defguard Internal CA",
   "settings_certs_certs_core_internal_description": "Manage certificates automatically generated by Defguard for secure communication.",
+  "settings_certs_certs_core_custom_title": "Your own certificate",
+  "settings_certs_certs_core_custom_description": "You have opted to deploy a custom Reverse Proxy and manage your own SSL certificates. ",
+  "settings_certs_certs_core_custom_change": "Change/upload certificate",
   "settings_vpn_stats_toggle_title": "Stats purge",
   "settings_vpn_stats_label_purge_frequency": "Stats purge frequency",
   "settings_vpn_stats_helper_purge_frequency": "",
diff --git a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
index 71ee6efef8..4a80cf520c 100644
--- a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
+++ b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
@@ -80,7 +80,7 @@ const Content = () => {
             <Button
               variant="primary"
               text={m.settings_certs_certs_core_none_add_certificate()}
-              onClick={handleDownloadCA}
+              onClick={() => {}}
               loading={false}
               disabled={false}
             />
@@ -91,9 +91,9 @@ const Content = () => {
             <DescriptionBlock title={m.settings_certs_certs_core_internal_title()}>
               <p>{m.settings_certs_certs_core_internal_description()}</p>
             </DescriptionBlock>
+            <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="outlined"
-              iconLeft="download"
               text={m.settings_certs_ca_download()}
               onClick={handleDownloadCA}
               loading={isFetching}
@@ -101,6 +101,21 @@ const Content = () => {
             />
           </>
         )}
+        {certsData?.core_http_cert_source === 'Custom' && (
+          <>
+            <DescriptionBlock title={m.settings_certs_certs_core_custom_title()}>
+              <p>{m.settings_certs_certs_core_custom_description()}</p>
+            </DescriptionBlock>
+            <SizedBox height={ThemeSpacing.Lg} />
+            <Button
+              variant="primary"
+              text={m.settings_certs_certs_core_custom_change()}
+              onClick={() => {}}
+              loading={false}
+              disabled={false}
+            />
+          </>
+        )}
       </MarkedSection>
       <Divider spacing={ThemeSpacing.Xl2} />
       <MarkedSection icon="globe">

From 9970ad7cfb5d4146e19068056b9685ebbe5523e8 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Thu, 2 Apr 2026 11:13:11 +0200
Subject: [PATCH 14/29] edge: none, self-signed, custom

---
 .../defguard_core/src/handlers/core_certs.rs  |  1 +
 web/messages/en/settings.json                 | 19 +++--
 .../SettingsCertificatesPage.tsx              | 78 ++++++++++++++++---
 web/src/shared/api/types.ts                   |  1 +
 4 files changed, 79 insertions(+), 20 deletions(-)

diff --git a/crates/defguard_core/src/handlers/core_certs.rs b/crates/defguard_core/src/handlers/core_certs.rs
index ef72dd17c6..de14350123 100644
--- a/crates/defguard_core/src/handlers/core_certs.rs
+++ b/crates/defguard_core/src/handlers/core_certs.rs
@@ -233,6 +233,7 @@ pub(crate) async fn get_certs(_role: AdminRole, Extension(pool): Extension<PgPoo
 			"core_http_cert_pem": certs.core_http_cert_pem,
 			"core_http_cert_source": certs.core_http_cert_source,
 			"core_http_cert_expiry": certs.core_http_cert_expiry,
+			"proxy_http_cert_pem": certs.proxy_http_cert_pem,
 			"proxy_http_cert_source": certs.proxy_http_cert_source,
 			"proxy_http_cert_expiry": certs.proxy_http_cert_expiry,
 		}),
diff --git a/web/messages/en/settings.json b/web/messages/en/settings.json
index 5b7a0a228a..88af2a5372 100644
--- a/web/messages/en/settings.json
+++ b/web/messages/en/settings.json
@@ -40,14 +40,17 @@
   "settings_certs_certs_title": "Edge/Core Certificates",
   "settings_certs_certs_description": "Add and manage certificates issued outside of Defguard. Use them to integrate existing infrastructure and maintain secure connections with external systems and services.",
   "settings_certs_certs_core_title": "Core certificate",
-  "settings_certs_certs_core_none_title": "No SSL certificate",
-  "settings_certs_certs_core_none_description": "You have opted to deploy a custom Reverse Proxy and manage your own SSL certificates. ",
-  "settings_certs_certs_core_none_add_certificate": "Add certificate",
-  "settings_certs_certs_core_internal_title": "Defguard Internal CA",
-  "settings_certs_certs_core_internal_description": "Manage certificates automatically generated by Defguard for secure communication.",
-  "settings_certs_certs_core_custom_title": "Your own certificate",
-  "settings_certs_certs_core_custom_description": "You have opted to deploy a custom Reverse Proxy and manage your own SSL certificates. ",
-  "settings_certs_certs_core_custom_change": "Change/upload certificate",
+  "settings_certs_certs_core_download": "Download Core certificate",
+  "settings_certs_certs_none_title": "No SSL certificate",
+  "settings_certs_certs_none_description": "You have opted to deploy a custom Reverse Proxy and manage your own SSL certificates. ",
+  "settings_certs_certs_none_add_certificate": "Add certificate",
+  "settings_certs_certs_internal_title": "Defguard Internal CA",
+  "settings_certs_certs_internal_description": "Manage certificates automatically generated by Defguard for secure communication.",
+  "settings_certs_certs_custom_title": "Your own certificate",
+  "settings_certs_certs_custom_description": "You have opted to deploy a custom Reverse Proxy and manage your own SSL certificates. ",
+  "settings_certs_certs_custom_change": "Change/upload certificate",
+  "settings_certs_certs_edge_title": "Edge certificate",
+  "settings_certs_certs_edge_download": "Download Edge certificate",
   "settings_vpn_stats_toggle_title": "Stats purge",
   "settings_vpn_stats_label_purge_frequency": "Stats purge frequency",
   "settings_vpn_stats_helper_purge_frequency": "",
diff --git a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
index 4a80cf520c..f943041079 100644
--- a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
+++ b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
@@ -58,7 +58,7 @@ const Content = () => {
     select: (resp) => resp.data,
   });
 
-  const handleDownloadCA = useCallback(() => {
+  const downloadCoreCert = useCallback(() => {
     const corePem = certsData?.core_http_cert_pem;
     if (!isPresent(corePem)) return;
     const blob = new Blob([corePem], {
@@ -67,19 +67,28 @@ const Content = () => {
     downloadFile(blob, 'defguard-core', 'pem');
   }, [certsData?.core_http_cert_pem]);
 
+  const downloadEdgeCert = useCallback(() => {
+    const edgePem = certsData?.proxy_http_cert_pem;
+    if (!isPresent(edgePem)) return;
+    const blob = new Blob([edgePem], {
+      type: 'application/x-pem-file;charset=utf-8',
+    });
+    downloadFile(blob, 'defguard-edge', 'pem');
+  }, [certsData?.proxy_http_cert_pem]);
+
   return (
     <>
       <MarkedSection icon="authorised-app">
         <MarkedSectionHeader title={m.settings_certs_certs_core_title()} />
         {certsData?.core_http_cert_source === 'None' && (
           <>
-            <DescriptionBlock title={m.settings_certs_certs_core_none_title()}>
-              <p>{m.settings_certs_certs_core_none_description()}</p>
+            <DescriptionBlock title={m.settings_certs_certs_none_title()}>
+              <p>{m.settings_certs_certs_none_description()}</p>
             </DescriptionBlock>
             <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="primary"
-              text={m.settings_certs_certs_core_none_add_certificate()}
+              text={m.settings_certs_certs_none_add_certificate()}
               onClick={() => {}}
               loading={false}
               disabled={false}
@@ -88,14 +97,14 @@ const Content = () => {
         )}
         {certsData?.core_http_cert_source === 'SelfSigned' && (
           <>
-            <DescriptionBlock title={m.settings_certs_certs_core_internal_title()}>
-              <p>{m.settings_certs_certs_core_internal_description()}</p>
+            <DescriptionBlock title={m.settings_certs_certs_internal_title()}>
+              <p>{m.settings_certs_certs_internal_description()}</p>
             </DescriptionBlock>
             <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="outlined"
-              text={m.settings_certs_ca_download()}
-              onClick={handleDownloadCA}
+              text={m.settings_certs_certs_core_download()}
+              onClick={downloadCoreCert}
               loading={isFetching}
               disabled={!isPresent(certsData?.core_http_cert_pem) || isFetching}
             />
@@ -103,13 +112,13 @@ const Content = () => {
         )}
         {certsData?.core_http_cert_source === 'Custom' && (
           <>
-            <DescriptionBlock title={m.settings_certs_certs_core_custom_title()}>
-              <p>{m.settings_certs_certs_core_custom_description()}</p>
+            <DescriptionBlock title={m.settings_certs_certs_custom_title()}>
+              <p>{m.settings_certs_certs_custom_description()}</p>
             </DescriptionBlock>
             <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="primary"
-              text={m.settings_certs_certs_core_custom_change()}
+              text={m.settings_certs_certs_custom_change()}
               onClick={() => {}}
               loading={false}
               disabled={false}
@@ -119,7 +128,52 @@ const Content = () => {
       </MarkedSection>
       <Divider spacing={ThemeSpacing.Xl2} />
       <MarkedSection icon="globe">
-        <MarkedSectionHeader title={m.settings_instance_section_core()} />
+        <MarkedSectionHeader title={m.settings_certs_certs_edge_title()} />
+        {certsData?.proxy_http_cert_source === 'None' && (
+          <>
+            <DescriptionBlock title={m.settings_certs_certs_none_title()}>
+              <p>{m.settings_certs_certs_none_description()}</p>
+            </DescriptionBlock>
+            <SizedBox height={ThemeSpacing.Lg} />
+            <Button
+              variant="primary"
+              text={m.settings_certs_certs_none_add_certificate()}
+              onClick={() => {}}
+              loading={false}
+              disabled={false}
+            />
+          </>
+        )}
+        {certsData?.proxy_http_cert_source === 'SelfSigned' && (
+          <>
+            <DescriptionBlock title={m.settings_certs_certs_internal_title()}>
+              <p>{m.settings_certs_certs_internal_description()}</p>
+            </DescriptionBlock>
+            <SizedBox height={ThemeSpacing.Lg} />
+            <Button
+              variant="outlined"
+              text={m.settings_certs_certs_edge_download()}
+              onClick={downloadEdgeCert}
+              loading={isFetching}
+              disabled={!isPresent(certsData?.proxy_http_cert_pem) || isFetching}
+            />
+          </>
+        )}
+        {certsData?.proxy_http_cert_source === 'Custom' && (
+          <>
+            <DescriptionBlock title={m.settings_certs_certs_custom_title()}>
+              <p>{m.settings_certs_certs_custom_description()}</p>
+            </DescriptionBlock>
+            <SizedBox height={ThemeSpacing.Lg} />
+            <Button
+              variant="primary"
+              text={m.settings_certs_certs_custom_change()}
+              onClick={() => {}}
+              loading={false}
+              disabled={false}
+            />
+          </>
+        )}
       </MarkedSection>
     </>
   );
diff --git a/web/src/shared/api/types.ts b/web/src/shared/api/types.ts
index 46fba6b2a5..a4ed4bac9d 100644
--- a/web/src/shared/api/types.ts
+++ b/web/src/shared/api/types.ts
@@ -72,6 +72,7 @@ export interface GetCertsResponse {
   core_http_cert_pem: string;
   core_http_cert_source: CoreCertSourceValue;
   core_http_cert_expiry: string;
+  proxy_http_cert_pem: string;
   proxy_http_cert_source: EdgeCertSourceValue;
   proxy_http_cert_expiry: string;
 }

From b4921ff57b13a5b440097ae80f56fc653fbc893e Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Thu, 2 Apr 2026 11:21:39 +0200
Subject: [PATCH 15/29] update custom cert description

---
 web/messages/en/settings.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/messages/en/settings.json b/web/messages/en/settings.json
index 88af2a5372..2dc8c978a2 100644
--- a/web/messages/en/settings.json
+++ b/web/messages/en/settings.json
@@ -47,7 +47,7 @@
   "settings_certs_certs_internal_title": "Defguard Internal CA",
   "settings_certs_certs_internal_description": "Manage certificates automatically generated by Defguard for secure communication.",
   "settings_certs_certs_custom_title": "Your own certificate",
-  "settings_certs_certs_custom_description": "You have opted to deploy a custom Reverse Proxy and manage your own SSL certificates. ",
+  "settings_certs_certs_custom_description": "You are using your own, custom SSL certificate.",
   "settings_certs_certs_custom_change": "Change/upload certificate",
   "settings_certs_certs_edge_title": "Edge certificate",
   "settings_certs_certs_edge_download": "Download Edge certificate",

From 2d74d1c667e440c878ec4c3aa1d38396495c1ef1 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Thu, 2 Apr 2026 13:08:21 +0200
Subject: [PATCH 16/29] core certs settings backend

---
 .../defguard_core/src/handlers/core_certs.rs  | 165 +++++++++++++++++-
 crates/defguard_core/src/handlers/mod.rs      |   2 +-
 crates/defguard_core/src/lib.rs               |   6 +-
 .../tests/integration/api/core_certs.rs       |  98 ++++++++++-
 .../src/handlers/auto_wizard.rs               | 133 ++------------
 5 files changed, 280 insertions(+), 124 deletions(-)

diff --git a/crates/defguard_core/src/handlers/core_certs.rs b/crates/defguard_core/src/handlers/core_certs.rs
index de14350123..7da5608a24 100644
--- a/crates/defguard_core/src/handlers/core_certs.rs
+++ b/crates/defguard_core/src/handlers/core_certs.rs
@@ -1,8 +1,9 @@
 use axum::{Extension, Json, extract::State, http::StatusCode};
 use defguard_certs::{
-    CertificateAuthority, CertificateInfo, Csr, DnType, der_to_pem, generate_key_pair,
+    CertificateAuthority, CertificateInfo, Csr, DnType, PemLabel, der_to_pem,
+    generate_key_pair, parse_pem_certificate,
 };
-use defguard_common::db::models::{Certificates, CoreCertSource};
+use defguard_common::db::models::{Certificates, CoreCertSource, settings::update_current_settings};
 use serde_json::json;
 use sqlx::PgPool;
 use utoipa::ToSchema;
@@ -14,6 +15,137 @@ use crate::{
     handlers::{ApiResponse, ApiResult},
 };
 
+/// SSL configuration type for Defguard's internal (core) web server.
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, ToSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum InternalSslType {
+    /// No SSL - plain HTTP, user manages reverse proxy / SSL termination themselves.
+    None,
+    /// Generate certificates using Defguard's internal Certificate Authority.
+    DefguardCa,
+    /// Upload a custom certificate and private key.
+    OwnCert,
+}
+
+#[derive(Serialize, Deserialize, Debug, ToSchema)]
+pub struct InternalUrlSettingsConfig {
+    pub ssl_type: InternalSslType,
+    pub cert_pem: Option<String>,
+    pub key_pem: Option<String>,
+}
+
+#[derive(Serialize, Debug, ToSchema)]
+pub struct CertInfoResponse {
+    pub common_name: String,
+    pub valid_for_days: i64,
+    pub not_before: String,
+    pub not_after: String,
+}
+
+/// Core logic for applying internal URL certificate settings using the current Defguard URL.
+/// Returns cert info if a certificate was generated/uploaded, `None` for `ssl_type = None`.
+pub async fn apply_internal_url_settings(
+    pool: &PgPool,
+    defguard_url: &str,
+    config: InternalUrlSettingsConfig,
+) -> Result<Option<CertInfoResponse>, WebError> {
+    debug!(
+        "Internal URL certificate settings received: defguard_url={}, ssl_type={:?}",
+        defguard_url, config.ssl_type,
+    );
+
+    let mut settings = defguard_common::db::models::Settings::get_current_settings();
+    settings.defguard_url = defguard_url.to_string();
+    update_current_settings(pool, settings).await?;
+
+    let mut certs = Certificates::get_or_default(pool)
+        .await
+        .map_err(WebError::from)?;
+
+    let cert_info = match config.ssl_type {
+        InternalSslType::None => {
+            certs.core_http_cert_source = CoreCertSource::None;
+            certs.core_http_cert_pem = None;
+            certs.core_http_cert_key_pem = None;
+            certs.core_http_cert_expiry = None;
+            certs.save(pool).await.map_err(WebError::from)?;
+            None
+        }
+        InternalSslType::DefguardCa => {
+            let hostname = reqwest::Url::parse(defguard_url)
+                .ok()
+                .and_then(|u| u.host_str().map(ToString::to_string))
+                .unwrap_or_else(|| defguard_url.to_string());
+
+            if certs.ca_cert_der.is_none() {
+                return Err(WebError::BadRequest(
+                    "CA certificate is not present; generate a CA first".to_string(),
+                ));
+            }
+
+            let ca_cert_der = certs.ca_cert_der.as_ref().expect("CA cert must be present");
+            let ca_key_der = certs.ca_key_der.as_ref().ok_or_else(|| {
+                WebError::BadRequest("CA private key not available for signing".to_string())
+            })?;
+
+            let ca = CertificateAuthority::from_cert_der_key_pair(ca_cert_der, ca_key_der)?;
+            let key_pair = generate_key_pair()?;
+            let san = vec![hostname.clone()];
+            let dn = vec![(DnType::CommonName, hostname.as_str())];
+            let csr = Csr::new(&key_pair, &san, dn)?;
+            let server_cert = ca.sign_csr(&csr)?;
+
+            let cert_der = server_cert.der().to_vec();
+            let cert_pem = der_to_pem(&cert_der, PemLabel::Certificate)?;
+            let key_pem = der_to_pem(key_pair.serialize_der().as_slice(), PemLabel::PrivateKey)?;
+            let info = CertificateInfo::from_der(&cert_der)?;
+            let valid_for_days = (info.not_after.and_utc() - chrono::Utc::now()).num_days();
+            let expiry = info.not_after;
+
+            certs.core_http_cert_source = CoreCertSource::SelfSigned;
+            certs.core_http_cert_pem = Some(cert_pem);
+            certs.core_http_cert_key_pem = Some(key_pem);
+            certs.core_http_cert_expiry = Some(expiry);
+            certs.save(pool).await.map_err(WebError::from)?;
+
+            Some(CertInfoResponse {
+                common_name: info.subject_common_name,
+                valid_for_days,
+                not_before: info.not_before.to_string(),
+                not_after: info.not_after.to_string(),
+            })
+        }
+        InternalSslType::OwnCert => {
+            let cert_pem_str = config.cert_pem.ok_or_else(|| {
+                WebError::BadRequest("cert_pem is required for own_cert".to_string())
+            })?;
+            let key_pem_str = config.key_pem.ok_or_else(|| {
+                WebError::BadRequest("key_pem is required for own_cert".to_string())
+            })?;
+
+            let cert_der = parse_pem_certificate(&cert_pem_str)?;
+            let info = CertificateInfo::from_der(cert_der.as_ref())?;
+            let valid_for_days = (info.not_after.and_utc() - chrono::Utc::now()).num_days();
+            let expiry = info.not_after;
+
+            certs.core_http_cert_source = CoreCertSource::Custom;
+            certs.core_http_cert_pem = Some(cert_pem_str);
+            certs.core_http_cert_key_pem = Some(key_pem_str);
+            certs.core_http_cert_expiry = Some(expiry);
+            certs.save(pool).await.map_err(WebError::from)?;
+
+            Some(CertInfoResponse {
+                common_name: info.subject_common_name,
+                valid_for_days,
+                not_before: info.not_before.to_string(),
+                not_after: info.not_after.to_string(),
+            })
+        }
+    };
+
+    Ok(cert_info)
+}
+
 /// Upload a custom PEM certificate + private key for core HTTPS.
 #[derive(Serialize, Deserialize, ToSchema)]
 pub struct CoreCustomCertUpload {
@@ -165,6 +297,35 @@ pub(crate) async fn core_cert_self_signed(
     Ok(ApiResponse::default())
 }
 
+#[utoipa::path(
+    post,
+    path = "/api/v1/core/cert/internal_url_settings",
+    request_body = InternalUrlSettingsConfig,
+    responses(
+        (status = 201, description = "Internal URL certificate settings applied.", body = ApiResponse),
+        (status = 400, description = "Invalid request.", body = ApiResponse),
+        (status = 401, description = "Unauthorized.", body = ApiResponse),
+        (status = 403, description = "Forbidden.", body = ApiResponse),
+        (status = 500, description = "Internal server error.", body = ApiResponse)
+    ),
+    security(("cookie" = []), ("api_token" = []))
+)]
+pub(crate) async fn set_internal_url_settings(
+    _role: AdminRole,
+    Extension(pool): Extension<PgPool>,
+    Json(config): Json<InternalUrlSettingsConfig>,
+) -> ApiResult {
+    info!("Applying core internal URL certificate settings");
+    let settings = defguard_common::db::models::Settings::get_current_settings();
+    let cert_info = apply_internal_url_settings(&pool, &settings.defguard_url, config).await?;
+    info!("Core internal URL certificate settings applied");
+
+    Ok(ApiResponse::new(
+        json!({ "cert_info": cert_info }),
+        StatusCode::CREATED,
+    ))
+}
+
 #[utoipa::path(
     post,
     path = "/api/v1/core/cert/ca",
diff --git a/crates/defguard_core/src/handlers/mod.rs b/crates/defguard_core/src/handlers/mod.rs
index 3fcbae9e1d..09c748e5ee 100644
--- a/crates/defguard_core/src/handlers/mod.rs
+++ b/crates/defguard_core/src/handlers/mod.rs
@@ -34,7 +34,7 @@ pub(crate) mod activity_log;
 pub(crate) mod app_info;
 pub mod auth;
 pub mod component_setup;
-pub(crate) mod core_certs;
+pub mod core_certs;
 pub(crate) mod forward_auth;
 pub mod gateway;
 pub(crate) mod group;
diff --git a/crates/defguard_core/src/lib.rs b/crates/defguard_core/src/lib.rs
index 68bd271900..90b869baac 100644
--- a/crates/defguard_core/src/lib.rs
+++ b/crates/defguard_core/src/lib.rs
@@ -117,7 +117,10 @@ use crate::{
             webauthn_start,
         },
         component_setup::setup_gateway_tls_stream,
-        core_certs::{core_cert_self_signed, core_cert_upload, get_ca, get_certs},
+        core_certs::{
+            core_cert_self_signed, core_cert_upload, get_ca, get_certs,
+            set_internal_url_settings,
+        },
         forward_auth::forward_auth,
         gateway::{delete_gateway, gateway_details, gateway_list, update_gateway},
         group::{
@@ -385,6 +388,7 @@ pub fn build_webapp(
             // Core HTTPS cert routes
             .route("/core/cert/upload", post(core_cert_upload))
             .route("/core/cert/self-signed", post(core_cert_self_signed))
+			.route("/core/cert/internal_url_settings", post(set_internal_url_settings))
 			.route("/core/cert/ca", get(get_ca))
 			.route("/core/cert/certs", get(get_certs))
             // Gateway routes
diff --git a/crates/defguard_core/tests/integration/api/core_certs.rs b/crates/defguard_core/tests/integration/api/core_certs.rs
index 8a8ea7a986..63241571e9 100644
--- a/crates/defguard_core/tests/integration/api/core_certs.rs
+++ b/crates/defguard_core/tests/integration/api/core_certs.rs
@@ -1,5 +1,7 @@
-use defguard_certs::CertificateAuthority;
-use defguard_common::db::models::{Certificates, CoreCertSource};
+use defguard_certs::{CertificateAuthority, Csr, DnType, PemLabel, der_to_pem, generate_key_pair};
+use defguard_common::db::models::{
+    Certificates, CoreCertSource, Settings, settings::update_current_settings,
+};
 use defguard_core::handlers::Auth;
 use reqwest::StatusCode;
 use serde_json::json;
@@ -18,6 +20,18 @@ async fn seed_ca(pool: &sqlx::PgPool) {
     certs.save(pool).await.unwrap();
 }
 
+fn generate_test_cert_pem(common_name: &str) -> (String, String) {
+    let ca = CertificateAuthority::new("Test CA", "test@example.com", 365).unwrap();
+    let key_pair = generate_key_pair().unwrap();
+    let san = vec![common_name.to_string()];
+    let dn = vec![(DnType::CommonName, common_name)];
+    let csr = Csr::new(&key_pair, &san, dn).unwrap();
+    let cert = ca.sign_csr(&csr).unwrap();
+    let cert_pem = der_to_pem(cert.der(), PemLabel::Certificate).unwrap();
+    let key_pem = der_to_pem(key_pair.serialize_der().as_slice(), PemLabel::PrivateKey).unwrap();
+    (cert_pem, key_pem)
+}
+
 #[sqlx::test]
 async fn test_core_cert_endpoints(_: PgPoolOptions, options: PgConnectOptions) {
     let pool = setup_pool(options).await;
@@ -93,3 +107,83 @@ async fn test_core_cert_endpoints(_: PgPoolOptions, options: PgConnectOptions) {
             .contains("BEGIN")
     );
 }
+
+#[sqlx::test]
+async fn test_internal_url_settings_endpoint(_: PgPoolOptions, options: PgConnectOptions) {
+    let pool = setup_pool(options).await;
+    let (client, _) = make_test_client(pool.clone()).await;
+
+    let auth = Auth::new("admin", "pass123");
+    let response = client.post("/api/v1/auth").json(&auth).send().await;
+    assert_eq!(response.status(), StatusCode::OK);
+
+    let mut settings = Settings::get_current_settings();
+    settings.defguard_url = "https://defguard.example.com".into();
+    update_current_settings(&pool, settings).await.unwrap();
+
+    let response = client
+        .post("/api/v1/core/cert/internal_url_settings")
+        .json(&json!({ "ssl_type": "none" }))
+        .send()
+        .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    let saved = Certificates::get(&pool).await.unwrap().unwrap();
+    assert_eq!(saved.core_http_cert_source, CoreCertSource::None);
+    assert!(saved.core_http_cert_pem.is_none());
+    assert!(saved.core_http_cert_key_pem.is_none());
+    assert!(saved.core_http_cert_expiry.is_none());
+
+    seed_ca(&pool).await;
+
+    let response = client
+        .post("/api/v1/core/cert/internal_url_settings")
+        .json(&json!({ "ssl_type": "defguard_ca" }))
+        .send()
+        .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    let body: serde_json::Value = response.json::<serde_json::Value>().await;
+    assert!(!body["cert_info"].is_null());
+    assert_eq!(body["cert_info"]["common_name"], "defguard.example.com");
+
+    let saved = Certificates::get(&pool).await.unwrap().unwrap();
+    assert_eq!(saved.core_http_cert_source, CoreCertSource::SelfSigned);
+    assert!(saved.core_http_cert_expiry.is_some());
+    assert!(
+        saved
+            .core_http_cert_pem
+            .as_deref()
+            .unwrap_or("")
+            .contains("BEGIN CERTIFICATE")
+    );
+
+    let (cert_pem, key_pem) = generate_test_cert_pem("uploaded.example.com");
+    let response = client
+        .post("/api/v1/core/cert/internal_url_settings")
+        .json(&json!({
+            "ssl_type": "own_cert",
+            "cert_pem": cert_pem,
+            "key_pem": key_pem
+        }))
+        .send()
+        .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    let body: serde_json::Value = response.json::<serde_json::Value>().await;
+    assert_eq!(body["cert_info"]["common_name"], "uploaded.example.com");
+
+    let saved = Certificates::get(&pool).await.unwrap().unwrap();
+    assert_eq!(saved.core_http_cert_source, CoreCertSource::Custom);
+    assert!(saved.core_http_cert_expiry.is_some());
+
+    let response = client
+        .post("/api/v1/core/cert/internal_url_settings")
+        .json(&json!({
+            "ssl_type": "own_cert",
+            "cert_pem": "-----BEGIN CERTIFICATE-----\nfake\n-----END CERTIFICATE-----\n"
+        }))
+        .send()
+        .await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+}
diff --git a/crates/defguard_setup/src/handlers/auto_wizard.rs b/crates/defguard_setup/src/handlers/auto_wizard.rs
index 48ee636117..fc3fda9a96 100644
--- a/crates/defguard_setup/src/handlers/auto_wizard.rs
+++ b/crates/defguard_setup/src/handlers/auto_wizard.rs
@@ -6,7 +6,7 @@ use defguard_certs::{
 use defguard_common::{
     db::models::{
         Certificates, WireguardNetwork,
-        certificates::{CoreCertSource, ProxyCertSource},
+        certificates::ProxyCertSource,
         initial_setup_wizard::InitialSetupStep,
         settings::update_current_settings,
         setup_auto_adoption::{AutoAdoptionWizardState, AutoAdoptionWizardStep},
@@ -18,10 +18,10 @@ use defguard_common::{
 use defguard_core::{
     auth::AdminOrSetupRole,
     error::WebError,
-    handlers::{ApiResponse, ApiResult},
+    handlers::{ApiResponse, ApiResult, core_certs},
 };
-use rcgen::DnType;
 use reqwest::StatusCode;
+use rcgen::DnType;
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use sqlx::{PgPool, query_scalar};
@@ -56,16 +56,7 @@ pub(crate) async fn advance_auto_wizard_to_step(
 }
 
 /// SSL configuration type for Defguard's internal (core) web server.
-#[derive(Deserialize, Serialize, Debug, Clone, PartialEq)]
-#[serde(rename_all = "snake_case")]
-pub enum InternalSslType {
-    /// No SSL - plain HTTP, user manages reverse proxy / SSL termination themselves.
-    None,
-    /// Generate certificates using Defguard's internal Certificate Authority.
-    DefguardCa,
-    /// Upload a custom certificate and private key.
-    OwnCert,
-}
+pub use core_certs::InternalSslType;
 
 #[derive(Deserialize, Serialize, Debug)]
 pub struct InternalUrlSettingsConfig {
@@ -75,13 +66,7 @@ pub struct InternalUrlSettingsConfig {
     key_pem: Option<String>,
 }
 
-#[derive(Serialize, Debug)]
-pub struct CertInfoResponse {
-    pub common_name: String,
-    pub valid_for_days: i64,
-    pub not_before: String,
-    pub not_after: String,
-}
+pub use core_certs::CertInfoResponse;
 
 /// Core logic for applying internal URL settings and configuring SSL for the core web server.
 /// Returns the cert info if a certificate was generated/uploaded, `None` for `ssl_type = None`.
@@ -89,104 +74,16 @@ pub(crate) async fn apply_internal_url_settings(
     pool: &PgPool,
     config: InternalUrlSettingsConfig,
 ) -> Result<Option<CertInfoResponse>, WebError> {
-    debug!(
-        "Internal URL settings received: defguard_url={}, ssl_type={:?}",
-        config.defguard_url, config.ssl_type,
-    );
-
-    let mut settings = defguard_common::db::models::Settings::get_current_settings();
-    settings.defguard_url = config.defguard_url.clone();
-    update_current_settings(pool, settings).await?;
-
-    let mut certs = Certificates::get_or_default(pool)
-        .await
-        .map_err(WebError::from)?;
-
-    let cert_info = match config.ssl_type {
-        InternalSslType::None => {
-            certs.core_http_cert_source = CoreCertSource::None;
-            certs.core_http_cert_pem = None;
-            certs.core_http_cert_key_pem = None;
-            certs.core_http_cert_expiry = None;
-            certs.save(pool).await.map_err(WebError::from)?;
-            None
-        }
-        InternalSslType::DefguardCa => {
-            // Extract hostname from defguard_url for the SAN.
-            let hostname = reqwest::Url::parse(&config.defguard_url)
-                .ok()
-                .and_then(|u| u.host_str().map(ToString::to_string))
-                .unwrap_or_else(|| config.defguard_url.clone());
-
-            // CA must already be present at this point.
-            if certs.ca_cert_der.is_none() {
-                return Err(WebError::BadRequest(
-                    "CA certificate is not present; generate a CA first".to_string(),
-                ));
-            }
-
-            // Generate server certificate signed by the CA.
-            let ca_cert_der = certs.ca_cert_der.as_ref().expect("CA cert must be present");
-            let ca_key_der = certs.ca_key_der.as_ref().ok_or_else(|| {
-                WebError::BadRequest("CA private key not available for signing".to_string())
-            })?;
-
-            let ca = CertificateAuthority::from_cert_der_key_pair(ca_cert_der, ca_key_der)?;
-            let key_pair = generate_key_pair()?;
-            let san = vec![hostname.clone()];
-            let dn = vec![(DnType::CommonName, hostname.as_str())];
-            let csr = Csr::new(&key_pair, &san, dn)?;
-            let server_cert = ca.sign_csr(&csr)?;
-
-            let cert_der = server_cert.der().to_vec();
-            let cert_pem = der_to_pem(&cert_der, PemLabel::Certificate)?;
-            let key_pem = der_to_pem(key_pair.serialize_der().as_slice(), PemLabel::PrivateKey)?;
-            let info = CertificateInfo::from_der(&cert_der)?;
-            let valid_for_days = (info.not_after.and_utc() - chrono::Utc::now()).num_days();
-            let expiry = info.not_after;
-
-            certs.core_http_cert_source = CoreCertSource::SelfSigned;
-            certs.core_http_cert_pem = Some(cert_pem);
-            certs.core_http_cert_key_pem = Some(key_pem);
-            certs.core_http_cert_expiry = Some(expiry);
-            certs.save(pool).await.map_err(WebError::from)?;
-
-            Some(CertInfoResponse {
-                common_name: info.subject_common_name,
-                valid_for_days,
-                not_before: info.not_before.to_string(),
-                not_after: info.not_after.to_string(),
-            })
-        }
-        InternalSslType::OwnCert => {
-            let cert_pem_str = config.cert_pem.ok_or_else(|| {
-                WebError::BadRequest("cert_pem is required for own_cert".to_string())
-            })?;
-            let key_pem_str = config.key_pem.ok_or_else(|| {
-                WebError::BadRequest("key_pem is required for own_cert".to_string())
-            })?;
-
-            let cert_der = parse_pem_certificate(&cert_pem_str)?;
-            let info = CertificateInfo::from_der(cert_der.as_ref())?;
-            let valid_for_days = (info.not_after.and_utc() - chrono::Utc::now()).num_days();
-            let expiry = info.not_after;
-
-            certs.core_http_cert_source = CoreCertSource::Custom;
-            certs.core_http_cert_pem = Some(cert_pem_str);
-            certs.core_http_cert_key_pem = Some(key_pem_str);
-            certs.core_http_cert_expiry = Some(expiry);
-            certs.save(pool).await.map_err(WebError::from)?;
-
-            Some(CertInfoResponse {
-                common_name: info.subject_common_name.clone(),
-                valid_for_days,
-                not_before: info.not_before.to_string(),
-                not_after: info.not_after.to_string(),
-            })
-        }
-    };
-
-    Ok(cert_info)
+    core_certs::apply_internal_url_settings(
+        pool,
+        &config.defguard_url,
+        core_certs::InternalUrlSettingsConfig {
+            ssl_type: config.ssl_type,
+            cert_pem: config.cert_pem,
+            key_pem: config.key_pem,
+        },
+    )
+    .await
 }
 
 /// Updates internal URL settings and configures SSL for the core web server.

From 00cd7dacd7beda254415a1bcaa82990bcc218599 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Thu, 2 Apr 2026 13:37:12 +0200
Subject: [PATCH 17/29] core cert settings wizard frontend

---
 web/messages/en/settings.json                 |  12 ++
 ...igrationWizardInternalUrlSslConfigStep.tsx |  95 +----------
 .../SettingsCoreCertificateWizardPage.tsx     |  68 ++++++++
 ...rtificateWizardInternalUrlSettingsStep.tsx | 160 ++++++++++++++++++
 ...tificateWizardInternalUrlSslConfigStep.tsx |  72 ++++++++
 ...ttingsCoreCertificateWizardSummaryStep.tsx |  46 +++++
 .../style.scss                                |  18 ++
 .../types.ts                                  |   8 +
 .../useSettingsCoreCertificateWizardStore.ts  |  51 ++++++
 .../AutoAdoptionInternalUrlSslConfigStep.tsx  |  95 +----------
 .../steps/SetupInternalUrlSslConfigStep.tsx   |  95 +----------
 .../SettingsCertificatesPage.tsx              |   9 +-
 web/src/routeTree.gen.ts                      |  23 +++
 .../_wizard/settings-core-certificate.tsx     |   6 +
 web/src/shared/api/api.ts                     |   7 +
 web/src/shared/api/types.ts                   |  10 ++
 .../InternalSslResult/InternalSslResult.tsx   | 104 ++++++++++++
 17 files changed, 614 insertions(+), 265 deletions(-)
 create mode 100644 web/src/pages/SettingsCoreCertificateWizardPage/SettingsCoreCertificateWizardPage.tsx
 create mode 100644 web/src/pages/SettingsCoreCertificateWizardPage/steps/SettingsCoreCertificateWizardInternalUrlSettingsStep.tsx
 create mode 100644 web/src/pages/SettingsCoreCertificateWizardPage/steps/SettingsCoreCertificateWizardInternalUrlSslConfigStep.tsx
 create mode 100644 web/src/pages/SettingsCoreCertificateWizardPage/steps/SettingsCoreCertificateWizardSummaryStep.tsx
 create mode 100644 web/src/pages/SettingsCoreCertificateWizardPage/style.scss
 create mode 100644 web/src/pages/SettingsCoreCertificateWizardPage/types.ts
 create mode 100644 web/src/pages/SettingsCoreCertificateWizardPage/useSettingsCoreCertificateWizardStore.ts
 create mode 100644 web/src/routes/_authorized/_wizard/settings-core-certificate.tsx
 create mode 100644 web/src/shared/components/certificates/InternalSslResult/InternalSslResult.tsx

diff --git a/web/messages/en/settings.json b/web/messages/en/settings.json
index 2dc8c978a2..ffdc8e9136 100644
--- a/web/messages/en/settings.json
+++ b/web/messages/en/settings.json
@@ -41,6 +41,18 @@
   "settings_certs_certs_description": "Add and manage certificates issued outside of Defguard. Use them to integrate existing infrastructure and maintain secure connections with external systems and services.",
   "settings_certs_certs_core_title": "Core certificate",
   "settings_certs_certs_core_download": "Download Core certificate",
+  "settings_certs_core_wizard_title": "Internal URL Settings",
+  "settings_certs_core_wizard_subtitle": "Reconfigure how Defguard secures the internal Core URL.",
+  "settings_certs_core_wizard_step_internal_url_settings_label": "Internal URL Settings",
+  "settings_certs_core_wizard_step_internal_url_settings_description": "Choose how SSL should be configured for the internal Core URL.",
+  "settings_certs_core_wizard_step_internal_url_ssl_config_label": "Internal URL SSL Configuration",
+  "settings_certs_core_wizard_step_internal_url_ssl_config_description": "Review the SSL configuration generated from your selected certificate type.",
+  "settings_certs_core_wizard_step_summary_label": "Summary",
+  "settings_certs_core_wizard_step_summary_description": "Review the result of the certificate configuration.",
+  "settings_certs_core_wizard_summary_success_title": "Configuration succeeded",
+  "settings_certs_core_wizard_summary_success_description": "Your Core certificate settings have been saved successfully.",
+  "settings_certs_core_wizard_summary_restart_required": "Restart the webserver to apply the new certificate.",
+  "settings_certs_core_wizard_summary_ok": "OK",
   "settings_certs_certs_none_title": "No SSL certificate",
   "settings_certs_certs_none_description": "You have opted to deploy a custom Reverse Proxy and manage your own SSL certificates. ",
   "settings_certs_certs_none_add_certificate": "Add certificate",
diff --git a/web/src/pages/MigrationWizardPage/steps/MigrationWizardInternalUrlSslConfigStep.tsx b/web/src/pages/MigrationWizardPage/steps/MigrationWizardInternalUrlSslConfigStep.tsx
index 301722d196..b02fac48e4 100644
--- a/web/src/pages/MigrationWizardPage/steps/MigrationWizardInternalUrlSslConfigStep.tsx
+++ b/web/src/pages/MigrationWizardPage/steps/MigrationWizardInternalUrlSslConfigStep.tsx
@@ -3,6 +3,7 @@ import { useEffect } from 'react';
 import { m } from '../../../paraglide/messages';
 import api from '../../../shared/api/api';
 import { Controls } from '../../../shared/components/Controls/Controls';
+import { InternalSslResult } from '../../../shared/components/certificates/InternalSslResult/InternalSslResult';
 import { WizardCard } from '../../../shared/components/wizard/WizardCard/WizardCard';
 import { Button } from '../../../shared/defguard-ui/components/Button/Button';
 import { Divider } from '../../../shared/defguard-ui/components/Divider/Divider';
@@ -42,95 +43,15 @@ export const MigrationWizardInternalUrlSslConfigStep = () => {
     );
   };
 
-  const renderContent = () => {
-    if (sslType === 'none') {
-      return (
-        <div className="ssl-result-card">
-          <div className="ssl-result-card-header">
-            <h3 className="green">
-              {m.initial_setup_auto_adoption_internal_url_ssl_no_ssl_title()}
-            </h3>
-            <p>{m.initial_setup_auto_adoption_internal_url_ssl_no_ssl_description()}</p>
-          </div>
-          <Divider />
-          <ul className="ssl-port-list">
-            <li>{m.initial_setup_auto_adoption_internal_url_ssl_no_ssl_port()}</li>
-          </ul>
-        </div>
-      );
-    }
-
-    if (sslType === 'defguard_ca') {
-      return (
-        <div className="ssl-result-validated-card">
-          <div className="ssl-result-validated-card-illustration">
-            <img src={caIcon} loading="lazy" alt="" />
-          </div>
-          <div className="ssl-result-validated-card-content">
-            <div className="ssl-result-card-header">
-              <h3>{m.initial_setup_auto_adoption_internal_url_ssl_ca_title()}</h3>
-              <p>{m.initial_setup_auto_adoption_internal_url_ssl_ca_description()}</p>
-            </div>
-            <div>
-              <Button
-                text={m.initial_setup_auto_adoption_internal_url_ssl_ca_download()}
-                variant="outlined"
-                iconLeft="download"
-                onClick={handleDownloadCaCert}
-                disabled={!sslInfoData?.ca_cert_pem}
-              />
-            </div>
-          </div>
-        </div>
-      );
-    }
-
-    if (sslType === 'own_cert' && certInfo) {
-      return (
-        <div className="ssl-result-validated-card">
-          <div className="ssl-result-validated-card-illustration">
-            <img src={caIcon} loading="lazy" alt="" />
-          </div>
-          <div className="ssl-result-validated-card-content">
-            <div className="ssl-result-card-header">
-              <h3>{m.initial_setup_auto_adoption_internal_url_ssl_own_title()}</h3>
-              <p>{m.initial_setup_auto_adoption_internal_url_ssl_own_description()}</p>
-            </div>
-            <div className="ssl-result-validated-card-info">
-              <p className="ssl-result-card-info-title">
-                {m.initial_setup_auto_adoption_internal_url_ssl_own_info_title()}
-              </p>
-              <Divider />
-              <div className="ssl-result-card-table">
-                <div className="ssl-result-card-table-row">
-                  <span className="label">
-                    {m.initial_setup_auto_adoption_internal_url_ssl_own_common_name()}
-                  </span>
-                  <span className="value">{certInfo.common_name}</span>
-                </div>
-                <div className="ssl-result-card-table-row">
-                  <span className="label">
-                    {m.initial_setup_auto_adoption_internal_url_ssl_own_validity()}
-                  </span>
-                  <span className="value">
-                    {m.initial_setup_auto_adoption_internal_url_ssl_own_validity_days({
-                      days: certInfo.valid_for_days,
-                    })}
-                  </span>
-                </div>
-              </div>
-            </div>
-          </div>
-        </div>
-      );
-    }
-
-    return null;
-  };
-
   return (
     <WizardCard>
-      {renderContent()}
+      <InternalSslResult
+        sslType={sslType}
+        certInfo={certInfo}
+        caCertPem={sslInfoData?.ca_cert_pem}
+        onDownloadCaCert={handleDownloadCaCert}
+        imageSrc={caIcon}
+      />
       <SizedBox height={ThemeSpacing.Xl3} />
       <Divider />
       <Controls>
diff --git a/web/src/pages/SettingsCoreCertificateWizardPage/SettingsCoreCertificateWizardPage.tsx b/web/src/pages/SettingsCoreCertificateWizardPage/SettingsCoreCertificateWizardPage.tsx
new file mode 100644
index 0000000000..f52d78efe7
--- /dev/null
+++ b/web/src/pages/SettingsCoreCertificateWizardPage/SettingsCoreCertificateWizardPage.tsx
@@ -0,0 +1,68 @@
+import { useNavigate } from '@tanstack/react-router';
+import { type ReactNode, useEffect, useMemo } from 'react';
+import { m } from '../../paraglide/messages';
+import type { WizardPageStep } from '../../shared/components/wizard/types';
+import { WizardPage } from '../../shared/components/wizard/WizardPage/WizardPage';
+import { SettingsCoreCertificateWizardInternalUrlSettingsStep } from './steps/SettingsCoreCertificateWizardInternalUrlSettingsStep';
+import { SettingsCoreCertificateWizardInternalUrlSslConfigStep } from './steps/SettingsCoreCertificateWizardInternalUrlSslConfigStep';
+import { SettingsCoreCertificateWizardSummaryStep } from './steps/SettingsCoreCertificateWizardSummaryStep';
+import {
+  SettingsCoreCertificateWizardStep,
+  type SettingsCoreCertificateWizardStepValue,
+} from './types';
+import { useSettingsCoreCertificateWizardStore } from './useSettingsCoreCertificateWizardStore';
+
+const steps: Record<SettingsCoreCertificateWizardStepValue, ReactNode> = {
+  internalUrlSettings: <SettingsCoreCertificateWizardInternalUrlSettingsStep />,
+  internalUrlSslConfig: <SettingsCoreCertificateWizardInternalUrlSslConfigStep />,
+  summary: <SettingsCoreCertificateWizardSummaryStep />,
+};
+
+export const SettingsCoreCertificateWizardPage = () => {
+  const activeStep = useSettingsCoreCertificateWizardStore((s) => s.activeStep);
+  const navigate = useNavigate();
+
+  useEffect(() => () => useSettingsCoreCertificateWizardStore.getState().reset(), []);
+
+  const stepsConfig = useMemo(
+    (): Record<SettingsCoreCertificateWizardStepValue, WizardPageStep> => ({
+      internalUrlSettings: {
+        id: SettingsCoreCertificateWizardStep.InternalUrlSettings,
+        order: 1,
+        label: m.settings_certs_core_wizard_step_internal_url_settings_label(),
+        description:
+          m.settings_certs_core_wizard_step_internal_url_settings_description(),
+      },
+      internalUrlSslConfig: {
+        id: SettingsCoreCertificateWizardStep.InternalUrlSslConfig,
+        order: 2,
+        label: m.settings_certs_core_wizard_step_internal_url_ssl_config_label(),
+        description:
+          m.settings_certs_core_wizard_step_internal_url_ssl_config_description(),
+      },
+      summary: {
+        id: SettingsCoreCertificateWizardStep.Summary,
+        order: 3,
+        label: m.settings_certs_core_wizard_step_summary_label(),
+        description: m.settings_certs_core_wizard_step_summary_description(),
+      },
+    }),
+    [],
+  );
+
+  return (
+    <WizardPage
+      id="settings-core-certificate-wizard"
+      activeStep={activeStep}
+      steps={stepsConfig}
+      title={m.settings_certs_core_wizard_title()}
+      subtitle={m.settings_certs_core_wizard_subtitle()}
+      onClose={() => {
+        useSettingsCoreCertificateWizardStore.getState().reset();
+        void navigate({ to: '/settings/certs', replace: true });
+      }}
+    >
+      {steps[activeStep]}
+    </WizardPage>
+  );
+};
diff --git a/web/src/pages/SettingsCoreCertificateWizardPage/steps/SettingsCoreCertificateWizardInternalUrlSettingsStep.tsx b/web/src/pages/SettingsCoreCertificateWizardPage/steps/SettingsCoreCertificateWizardInternalUrlSettingsStep.tsx
new file mode 100644
index 0000000000..4306c66520
--- /dev/null
+++ b/web/src/pages/SettingsCoreCertificateWizardPage/steps/SettingsCoreCertificateWizardInternalUrlSettingsStep.tsx
@@ -0,0 +1,160 @@
+import { useMutation } from '@tanstack/react-query';
+import z from 'zod';
+import { m } from '../../../paraglide/messages';
+import api from '../../../shared/api/api';
+import type { InternalSslType } from '../../../shared/api/types';
+import { Controls } from '../../../shared/components/Controls/Controls';
+import { WizardCard } from '../../../shared/components/wizard/WizardCard/WizardCard';
+import { Button } from '../../../shared/defguard-ui/components/Button/Button';
+import { Divider } from '../../../shared/defguard-ui/components/Divider/Divider';
+import { Helper } from '../../../shared/defguard-ui/components/Helper/Helper';
+import { Radio } from '../../../shared/defguard-ui/components/Radio/Radio';
+import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
+import { Snackbar } from '../../../shared/defguard-ui/providers/snackbar/snackbar';
+import { ThemeSpacing } from '../../../shared/defguard-ui/types';
+import { useAppForm } from '../../../shared/form';
+import { formChangeLogic } from '../../../shared/formLogic';
+import '../../SetupPage/autoAdoption/steps/style.scss';
+import { SettingsCoreCertificateWizardStep } from '../types';
+import { useSettingsCoreCertificateWizardStore } from '../useSettingsCoreCertificateWizardStore';
+
+export const SettingsCoreCertificateWizardInternalUrlSettingsStep = () => {
+  const storedSslType = useSettingsCoreCertificateWizardStore((s) => s.internal_ssl_type);
+
+  const formSchema = z.object({
+    ssl_type: z.custom<InternalSslType>(),
+    cert_pem_file: z.custom<File | null>().nullable(),
+    key_pem_file: z.custom<File | null>().nullable(),
+  });
+
+  const { mutate, isPending } = useMutation({
+    mutationFn: api.core.setInternalUrlSettings,
+    meta: { invalidate: [['core', 'cert', 'certs']] },
+    onSuccess: (response) => {
+      useSettingsCoreCertificateWizardStore.setState({
+        internal_ssl_type: form.getFieldValue('ssl_type'),
+        internal_ssl_cert_info: response.data.cert_info ?? null,
+        activeStep: SettingsCoreCertificateWizardStep.InternalUrlSslConfig,
+      });
+    },
+    onError: (error) => {
+      Snackbar.error(m.settings_msg_save_failed());
+      console.error('Failed to save core internal URL settings:', error);
+    },
+  });
+
+  const form = useAppForm({
+    defaultValues: {
+      ssl_type: (storedSslType ?? 'none') as InternalSslType,
+      cert_pem_file: null as File | null,
+      key_pem_file: null as File | null,
+    },
+    validationLogic: formChangeLogic,
+    validators: { onSubmit: formSchema, onChange: formSchema },
+    onSubmit: async ({ value }) => {
+      if (
+        value.ssl_type === 'own_cert' &&
+        (!value.cert_pem_file || !value.key_pem_file)
+      ) {
+        Snackbar.error(
+          m.initial_setup_auto_adoption_internal_url_settings_upload_files_required(),
+        );
+        return;
+      }
+
+      mutate({
+        ssl_type: value.ssl_type,
+        cert_pem: value.cert_pem_file ? await value.cert_pem_file.text() : undefined,
+        key_pem: value.key_pem_file ? await value.key_pem_file.text() : undefined,
+      });
+    },
+  });
+
+  return (
+    <WizardCard>
+      <form
+        onSubmit={(e) => {
+          e.stopPropagation();
+          e.preventDefault();
+          form.handleSubmit();
+        }}
+      >
+        <form.AppForm>
+          <p>{m.initial_setup_auto_adoption_internal_url_settings_url_description()}</p>
+          <SizedBox height={ThemeSpacing.Xl} />
+          <form.Subscribe selector={(s) => s.values.ssl_type}>
+            {(sslType) => (
+              <div className="ssl-options">
+                <div className="ssl-option-row">
+                  <Radio
+                    text={m.initial_setup_auto_adoption_internal_url_settings_ssl_option_none()}
+                    active={sslType === 'none'}
+                    onClick={() => form.setFieldValue('ssl_type', 'none')}
+                  />
+                  <Helper>
+                    {m.initial_setup_auto_adoption_internal_url_settings_ssl_option_none_help()}
+                  </Helper>
+                </div>
+                <SizedBox height={ThemeSpacing.Md} />
+                <div className="ssl-option-row">
+                  <Radio
+                    text={m.initial_setup_auto_adoption_internal_url_settings_ssl_option_defguard_ca()}
+                    active={sslType === 'defguard_ca'}
+                    onClick={() => form.setFieldValue('ssl_type', 'defguard_ca')}
+                  />
+                  <Helper>
+                    {m.initial_setup_auto_adoption_internal_url_settings_ssl_option_defguard_ca_help()}
+                  </Helper>
+                </div>
+                <SizedBox height={ThemeSpacing.Md} />
+                <div className="ssl-option-row">
+                  <Radio
+                    text={m.initial_setup_auto_adoption_internal_url_settings_ssl_option_own_cert()}
+                    active={sslType === 'own_cert'}
+                    onClick={() => form.setFieldValue('ssl_type', 'own_cert')}
+                  />
+                  <Helper>
+                    {m.initial_setup_auto_adoption_internal_url_settings_ssl_option_own_cert_help()}
+                  </Helper>
+                </div>
+                {sslType === 'own_cert' && (
+                  <div className="cert-upload-section">
+                    <SizedBox height={ThemeSpacing.Lg} />
+                    <form.AppField name="cert_pem_file">
+                      {(field) => (
+                        <field.FormUploadField
+                          acceptedExtensions={['.pem', '.crt', '.cer']}
+                          title={m.initial_setup_auto_adoption_internal_url_settings_upload_cert_button()}
+                        />
+                      )}
+                    </form.AppField>
+                    <SizedBox height={ThemeSpacing.Md} />
+                    <form.AppField name="key_pem_file">
+                      {(field) => (
+                        <field.FormUploadField
+                          acceptedExtensions={['.pem', '.key']}
+                          title={m.initial_setup_auto_adoption_internal_url_settings_upload_key_button()}
+                        />
+                      )}
+                    </form.AppField>
+                  </div>
+                )}
+              </div>
+            )}
+          </form.Subscribe>
+        </form.AppForm>
+      </form>
+      <SizedBox height={ThemeSpacing.Xl3} />
+      <Divider />
+      <Controls>
+        <div className="right">
+          <Button
+            text={m.controls_continue()}
+            onClick={form.handleSubmit}
+            loading={isPending}
+          />
+        </div>
+      </Controls>
+    </WizardCard>
+  );
+};
diff --git a/web/src/pages/SettingsCoreCertificateWizardPage/steps/SettingsCoreCertificateWizardInternalUrlSslConfigStep.tsx b/web/src/pages/SettingsCoreCertificateWizardPage/steps/SettingsCoreCertificateWizardInternalUrlSslConfigStep.tsx
new file mode 100644
index 0000000000..aa9ec0daa9
--- /dev/null
+++ b/web/src/pages/SettingsCoreCertificateWizardPage/steps/SettingsCoreCertificateWizardInternalUrlSslConfigStep.tsx
@@ -0,0 +1,72 @@
+import { useQuery } from '@tanstack/react-query';
+import { useEffect } from 'react';
+import { m } from '../../../paraglide/messages';
+import api from '../../../shared/api/api';
+import { Controls } from '../../../shared/components/Controls/Controls';
+import { InternalSslResult } from '../../../shared/components/certificates/InternalSslResult/InternalSslResult';
+import { WizardCard } from '../../../shared/components/wizard/WizardCard/WizardCard';
+import { Button } from '../../../shared/defguard-ui/components/Button/Button';
+import { Divider } from '../../../shared/defguard-ui/components/Divider/Divider';
+import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
+import { ThemeSpacing } from '../../../shared/defguard-ui/types';
+import { downloadFile } from '../../../shared/utils/download';
+import caIcon from '../../SetupPage/assets/ca.png';
+import '../../SetupPage/autoAdoption/steps/style.scss';
+import { SettingsCoreCertificateWizardStep } from '../types';
+import { useSettingsCoreCertificateWizardStore } from '../useSettingsCoreCertificateWizardStore';
+
+export const SettingsCoreCertificateWizardInternalUrlSslConfigStep = () => {
+  const sslType = useSettingsCoreCertificateWizardStore((s) => s.internal_ssl_type);
+  const certInfo = useSettingsCoreCertificateWizardStore((s) => s.internal_ssl_cert_info);
+
+  useEffect(() => {
+    if (sslType === null) {
+      useSettingsCoreCertificateWizardStore.setState({
+        activeStep: SettingsCoreCertificateWizardStep.InternalUrlSettings,
+      });
+    }
+  }, [sslType]);
+
+  const { data: caData } = useQuery({
+    queryKey: ['core', 'cert', 'ca'],
+    queryFn: api.core.getCA,
+    enabled: sslType === 'defguard_ca',
+    select: (response) => response.data,
+  });
+
+  const handleDownloadCaCert = () => {
+    if (!caData?.ca_cert_pem) return;
+    downloadFile(
+      new Blob([caData.ca_cert_pem], { type: 'application/x-pem-file' }),
+      'defguard-ca',
+      'pem',
+    );
+  };
+
+  return (
+    <WizardCard>
+      <InternalSslResult
+        sslType={sslType}
+        certInfo={certInfo}
+        caCertPem={caData?.ca_cert_pem}
+        onDownloadCaCert={handleDownloadCaCert}
+        imageSrc={caIcon}
+      />
+      <SizedBox height={ThemeSpacing.Xl3} />
+      <Divider />
+      <Controls>
+        <Button
+          text={m.controls_back()}
+          variant="outlined"
+          onClick={() => useSettingsCoreCertificateWizardStore.getState().back()}
+        />
+        <div className="right">
+          <Button
+            text={m.controls_continue()}
+            onClick={() => useSettingsCoreCertificateWizardStore.getState().next()}
+          />
+        </div>
+      </Controls>
+    </WizardCard>
+  );
+};
diff --git a/web/src/pages/SettingsCoreCertificateWizardPage/steps/SettingsCoreCertificateWizardSummaryStep.tsx b/web/src/pages/SettingsCoreCertificateWizardPage/steps/SettingsCoreCertificateWizardSummaryStep.tsx
new file mode 100644
index 0000000000..88ccd5fa21
--- /dev/null
+++ b/web/src/pages/SettingsCoreCertificateWizardPage/steps/SettingsCoreCertificateWizardSummaryStep.tsx
@@ -0,0 +1,46 @@
+import { useQueryClient } from '@tanstack/react-query';
+import { useNavigate } from '@tanstack/react-router';
+import { m } from '../../../paraglide/messages';
+import { Controls } from '../../../shared/components/Controls/Controls';
+import { WizardCard } from '../../../shared/components/wizard/WizardCard/WizardCard';
+import { Button } from '../../../shared/defguard-ui/components/Button/Button';
+import { Divider } from '../../../shared/defguard-ui/components/Divider/Divider';
+import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
+import { ThemeSpacing } from '../../../shared/defguard-ui/types';
+import { useSettingsCoreCertificateWizardStore } from '../useSettingsCoreCertificateWizardStore';
+import '../style.scss';
+
+export const SettingsCoreCertificateWizardSummaryStep = () => {
+  const navigate = useNavigate();
+  const queryClient = useQueryClient();
+
+  const handleFinish = async () => {
+    await queryClient.invalidateQueries({ queryKey: ['core', 'cert', 'certs'] });
+    useSettingsCoreCertificateWizardStore.getState().reset();
+    await navigate({ to: '/settings/certs' });
+  };
+
+  return (
+    <WizardCard className="settings-core-certificate-summary-card">
+      <p className="summary-title">
+        {m.settings_certs_core_wizard_summary_success_title()}
+      </p>
+      <SizedBox height={ThemeSpacing.Md} />
+      <p className="summary-description">
+        {m.settings_certs_core_wizard_summary_success_description()}
+      </p>
+      <Divider spacing={ThemeSpacing.Xl} />
+      <p className="summary-restart">
+        {m.settings_certs_core_wizard_summary_restart_required()}
+      </p>
+      <Controls>
+        <div className="right">
+          <Button
+            text={m.settings_certs_core_wizard_summary_ok()}
+            onClick={handleFinish}
+          />
+        </div>
+      </Controls>
+    </WizardCard>
+  );
+};
diff --git a/web/src/pages/SettingsCoreCertificateWizardPage/style.scss b/web/src/pages/SettingsCoreCertificateWizardPage/style.scss
new file mode 100644
index 0000000000..92b32c41ac
--- /dev/null
+++ b/web/src/pages/SettingsCoreCertificateWizardPage/style.scss
@@ -0,0 +1,18 @@
+.settings-core-certificate-summary-card {
+  .summary-title {
+    font: var(--t-title-h4);
+    color: var(--fg-neutral);
+    margin: 0;
+  }
+
+  .summary-description,
+  .summary-restart {
+    font: var(--t-body-primary-400);
+    color: var(--fg-neutral);
+    margin: 0;
+  }
+
+  .summary-restart {
+    color: var(--fg-faded);
+  }
+}
diff --git a/web/src/pages/SettingsCoreCertificateWizardPage/types.ts b/web/src/pages/SettingsCoreCertificateWizardPage/types.ts
new file mode 100644
index 0000000000..0485b12efd
--- /dev/null
+++ b/web/src/pages/SettingsCoreCertificateWizardPage/types.ts
@@ -0,0 +1,8 @@
+export const SettingsCoreCertificateWizardStep = {
+  InternalUrlSettings: 'internalUrlSettings',
+  InternalUrlSslConfig: 'internalUrlSslConfig',
+  Summary: 'summary',
+} as const;
+
+export type SettingsCoreCertificateWizardStepValue =
+  (typeof SettingsCoreCertificateWizardStep)[keyof typeof SettingsCoreCertificateWizardStep];
diff --git a/web/src/pages/SettingsCoreCertificateWizardPage/useSettingsCoreCertificateWizardStore.ts b/web/src/pages/SettingsCoreCertificateWizardPage/useSettingsCoreCertificateWizardStore.ts
new file mode 100644
index 0000000000..44148f12b8
--- /dev/null
+++ b/web/src/pages/SettingsCoreCertificateWizardPage/useSettingsCoreCertificateWizardStore.ts
@@ -0,0 +1,51 @@
+import { create } from 'zustand';
+import type { CertInfo, InternalSslType } from '../../shared/api/types';
+import {
+  SettingsCoreCertificateWizardStep,
+  type SettingsCoreCertificateWizardStepValue,
+} from './types';
+
+type StoreValues = {
+  activeStep: SettingsCoreCertificateWizardStepValue;
+  internal_ssl_type: InternalSslType | null;
+  internal_ssl_cert_info: CertInfo | null;
+};
+
+type Store = StoreValues & {
+  setState: (values: Partial<StoreValues>) => void;
+  reset: () => void;
+  next: () => void;
+  back: () => void;
+};
+
+const defaults: StoreValues = {
+  activeStep: SettingsCoreCertificateWizardStep.InternalUrlSettings,
+  internal_ssl_type: null,
+  internal_ssl_cert_info: null,
+};
+
+export const useSettingsCoreCertificateWizardStore = create<Store>()((set, get) => ({
+  ...defaults,
+  setState: (values) => set(values),
+  reset: () => set(defaults),
+  next: () => {
+    const activeStep = get().activeStep;
+    if (activeStep === SettingsCoreCertificateWizardStep.InternalUrlSettings) {
+      set({ activeStep: SettingsCoreCertificateWizardStep.InternalUrlSslConfig });
+      return;
+    }
+    if (activeStep === SettingsCoreCertificateWizardStep.InternalUrlSslConfig) {
+      set({ activeStep: SettingsCoreCertificateWizardStep.Summary });
+    }
+  },
+  back: () => {
+    const activeStep = get().activeStep;
+    if (activeStep === SettingsCoreCertificateWizardStep.Summary) {
+      set({ activeStep: SettingsCoreCertificateWizardStep.InternalUrlSslConfig });
+      return;
+    }
+    if (activeStep === SettingsCoreCertificateWizardStep.InternalUrlSslConfig) {
+      set({ activeStep: SettingsCoreCertificateWizardStep.InternalUrlSettings });
+    }
+  },
+}));
diff --git a/web/src/pages/SetupPage/autoAdoption/steps/AutoAdoptionInternalUrlSslConfigStep.tsx b/web/src/pages/SetupPage/autoAdoption/steps/AutoAdoptionInternalUrlSslConfigStep.tsx
index 4b6443711a..4abbc457da 100644
--- a/web/src/pages/SetupPage/autoAdoption/steps/AutoAdoptionInternalUrlSslConfigStep.tsx
+++ b/web/src/pages/SetupPage/autoAdoption/steps/AutoAdoptionInternalUrlSslConfigStep.tsx
@@ -3,6 +3,7 @@ import { useEffect } from 'react';
 import { m } from '../../../../paraglide/messages';
 import api from '../../../../shared/api/api';
 import { Controls } from '../../../../shared/components/Controls/Controls';
+import { InternalSslResult } from '../../../../shared/components/certificates/InternalSslResult/InternalSslResult';
 import { WizardCard } from '../../../../shared/components/wizard/WizardCard/WizardCard';
 import { Button } from '../../../../shared/defguard-ui/components/Button/Button';
 import { Divider } from '../../../../shared/defguard-ui/components/Divider/Divider';
@@ -43,95 +44,15 @@ export const AutoAdoptionInternalUrlSslConfigStep = () => {
     );
   };
 
-  const renderContent = () => {
-    if (sslType === 'none') {
-      return (
-        <div className="ssl-result-card">
-          <div className="ssl-result-card-header">
-            <h3 className="green">
-              {m.initial_setup_auto_adoption_internal_url_ssl_no_ssl_title()}
-            </h3>
-            <p>{m.initial_setup_auto_adoption_internal_url_ssl_no_ssl_description()}</p>
-          </div>
-          <Divider />
-          <ul className="ssl-port-list">
-            <li>{m.initial_setup_auto_adoption_internal_url_ssl_no_ssl_port()}</li>
-          </ul>
-        </div>
-      );
-    }
-
-    if (sslType === 'defguard_ca') {
-      return (
-        <div className="ssl-result-validated-card">
-          <div className="ssl-result-validated-card-illustration">
-            <img src={caIcon} loading="lazy" alt="" />
-          </div>
-          <div className="ssl-result-validated-card-content">
-            <div className="ssl-result-card-header">
-              <h3>{m.initial_setup_auto_adoption_internal_url_ssl_ca_title()}</h3>
-              <p>{m.initial_setup_auto_adoption_internal_url_ssl_ca_description()}</p>
-            </div>
-            <div>
-              <Button
-                text={m.initial_setup_auto_adoption_internal_url_ssl_ca_download()}
-                variant="outlined"
-                iconLeft="download"
-                onClick={handleDownloadCaCert}
-                disabled={!sslInfoData?.ca_cert_pem}
-              />
-            </div>
-          </div>
-        </div>
-      );
-    }
-
-    if (sslType === 'own_cert' && certInfo) {
-      return (
-        <div className="ssl-result-validated-card">
-          <div className="ssl-result-validated-card-illustration">
-            <img src={caIcon} loading="lazy" alt="" />
-          </div>
-          <div className="ssl-result-validated-card-content">
-            <div className="ssl-result-card-header">
-              <h3>{m.initial_setup_auto_adoption_internal_url_ssl_own_title()}</h3>
-              <p>{m.initial_setup_auto_adoption_internal_url_ssl_own_description()}</p>
-            </div>
-            <div className="ssl-result-validated-card-info">
-              <p className="ssl-result-card-info-title">
-                {m.initial_setup_auto_adoption_internal_url_ssl_own_info_title()}
-              </p>
-              <Divider />
-              <div className="ssl-result-card-table">
-                <div className="ssl-result-card-table-row">
-                  <span className="label">
-                    {m.initial_setup_auto_adoption_internal_url_ssl_own_common_name()}
-                  </span>
-                  <span className="value">{certInfo.common_name}</span>
-                </div>
-                <div className="ssl-result-card-table-row">
-                  <span className="label">
-                    {m.initial_setup_auto_adoption_internal_url_ssl_own_validity()}
-                  </span>
-                  <span className="value">
-                    {m.initial_setup_auto_adoption_internal_url_ssl_own_validity_days({
-                      days: certInfo.valid_for_days,
-                    })}
-                  </span>
-                </div>
-              </div>
-            </div>
-          </div>
-        </div>
-      );
-    }
-
-    return null;
-  };
-
   return (
     <WizardCard>
-      {renderContent()}
+      <InternalSslResult
+        sslType={sslType}
+        certInfo={certInfo}
+        caCertPem={sslInfoData?.ca_cert_pem}
+        onDownloadCaCert={handleDownloadCaCert}
+        imageSrc={caIcon}
+      />
       <SizedBox height={ThemeSpacing.Xl3} />
       <Divider />
       <Controls>
diff --git a/web/src/pages/SetupPage/initial/steps/SetupInternalUrlSslConfigStep.tsx b/web/src/pages/SetupPage/initial/steps/SetupInternalUrlSslConfigStep.tsx
index 5ec4a6436f..88d9a8f5a1 100644
--- a/web/src/pages/SetupPage/initial/steps/SetupInternalUrlSslConfigStep.tsx
+++ b/web/src/pages/SetupPage/initial/steps/SetupInternalUrlSslConfigStep.tsx
@@ -3,6 +3,7 @@ import { useEffect } from 'react';
 import { m } from '../../../../paraglide/messages';
 import api from '../../../../shared/api/api';
 import { Controls } from '../../../../shared/components/Controls/Controls';
+import { InternalSslResult } from '../../../../shared/components/certificates/InternalSslResult/InternalSslResult';
 import { WizardCard } from '../../../../shared/components/wizard/WizardCard/WizardCard';
 import { Button } from '../../../../shared/defguard-ui/components/Button/Button';
 import { Divider } from '../../../../shared/defguard-ui/components/Divider/Divider';
@@ -44,95 +45,15 @@ export const SetupInternalUrlSslConfigStep = () => {
     );
   };
 
-  const renderContent = () => {
-    if (sslType === 'none') {
-      return (
-        <div className="ssl-result-card">
-          <div className="ssl-result-card-header">
-            <h3 className="green">
-              {m.initial_setup_auto_adoption_internal_url_ssl_no_ssl_title()}
-            </h3>
-            <p>{m.initial_setup_auto_adoption_internal_url_ssl_no_ssl_description()}</p>
-          </div>
-          <Divider />
-          <ul className="ssl-port-list">
-            <li>{m.initial_setup_auto_adoption_internal_url_ssl_no_ssl_port()}</li>
-          </ul>
-        </div>
-      );
-    }
-
-    if (sslType === 'defguard_ca') {
-      return (
-        <div className="ssl-result-validated-card">
-          <div className="ssl-result-validated-card-illustration">
-            <img src={caIcon} loading="lazy" alt="" />
-          </div>
-          <div className="ssl-result-validated-card-content">
-            <div className="ssl-result-card-header">
-              <h3>{m.initial_setup_auto_adoption_internal_url_ssl_ca_title()}</h3>
-              <p>{m.initial_setup_auto_adoption_internal_url_ssl_ca_description()}</p>
-            </div>
-            <div>
-              <Button
-                text={m.initial_setup_auto_adoption_internal_url_ssl_ca_download()}
-                variant="outlined"
-                iconLeft="download"
-                onClick={handleDownloadCaCert}
-                disabled={!sslInfoData?.ca_cert_pem}
-              />
-            </div>
-          </div>
-        </div>
-      );
-    }
-
-    if (sslType === 'own_cert' && certInfo) {
-      return (
-        <div className="ssl-result-validated-card">
-          <div className="ssl-result-validated-card-illustration">
-            <img src={caIcon} loading="lazy" alt="" />
-          </div>
-          <div className="ssl-result-validated-card-content">
-            <div className="ssl-result-card-header">
-              <h3>{m.initial_setup_auto_adoption_internal_url_ssl_own_title()}</h3>
-              <p>{m.initial_setup_auto_adoption_internal_url_ssl_own_description()}</p>
-            </div>
-            <div className="ssl-result-validated-card-info">
-              <p className="ssl-result-card-info-title">
-                {m.initial_setup_auto_adoption_internal_url_ssl_own_info_title()}
-              </p>
-              <Divider />
-              <div className="ssl-result-card-table">
-                <div className="ssl-result-card-table-row">
-                  <span className="label">
-                    {m.initial_setup_auto_adoption_internal_url_ssl_own_common_name()}
-                  </span>
-                  <span className="value">{certInfo.common_name}</span>
-                </div>
-                <div className="ssl-result-card-table-row">
-                  <span className="label">
-                    {m.initial_setup_auto_adoption_internal_url_ssl_own_validity()}
-                  </span>
-                  <span className="value">
-                    {m.initial_setup_auto_adoption_internal_url_ssl_own_validity_days({
-                      days: certInfo.valid_for_days,
-                    })}
-                  </span>
-                </div>
-              </div>
-            </div>
-          </div>
-        </div>
-      );
-    }
-
-    return null;
-  };
-
   return (
     <WizardCard>
-      {renderContent()}
+      <InternalSslResult
+        sslType={sslType}
+        certInfo={certInfo}
+        caCertPem={sslInfoData?.ca_cert_pem}
+        onDownloadCaCert={handleDownloadCaCert}
+        imageSrc={caIcon}
+      />
       <SizedBox height={ThemeSpacing.Xl3} />
       <Divider />
       <Controls>
diff --git a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
index f943041079..c916b7683e 100644
--- a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
+++ b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
@@ -1,5 +1,5 @@
 import { useQuery } from '@tanstack/react-query';
-import { Link } from '@tanstack/react-router';
+import { Link, useNavigate } from '@tanstack/react-router';
 import { useCallback } from 'react';
 import { m } from '../../../paraglide/messages';
 import api from '../../../shared/api/api';
@@ -13,10 +13,10 @@ import { Button } from '../../../shared/defguard-ui/components/Button/Button';
 import { Divider } from '../../../shared/defguard-ui/components/Divider/Divider';
 import { MarkedSection } from '../../../shared/defguard-ui/components/MarkedSection/MarkedSection';
 import { MarkedSectionHeader } from '../../../shared/defguard-ui/components/MarkedSectionHeader/MarkedSectionHeader';
+import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { ThemeSpacing } from '../../../shared/defguard-ui/types';
 import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
 import { downloadFile } from '../../../shared/utils/download';
-import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
 
 const breadcrumbs = [
   <Link
@@ -52,6 +52,7 @@ export const SettingsCertificatesPage = () => {
 };
 
 const Content = () => {
+  const navigate = useNavigate();
   const { data: certsData, isFetching } = useQuery({
     queryKey: ['core', 'cert', 'certs'],
     queryFn: api.core.getCerts,
@@ -89,7 +90,7 @@ const Content = () => {
             <Button
               variant="primary"
               text={m.settings_certs_certs_none_add_certificate()}
-              onClick={() => {}}
+              onClick={() => void navigate({ to: '/settings-core-certificate' })}
               loading={false}
               disabled={false}
             />
@@ -119,7 +120,7 @@ const Content = () => {
             <Button
               variant="primary"
               text={m.settings_certs_certs_custom_change()}
-              onClick={() => {}}
+              onClick={() => void navigate({ to: '/settings-core-certificate' })}
               loading={false}
               disabled={false}
             />
diff --git a/web/src/routeTree.gen.ts b/web/src/routeTree.gen.ts
index 63a87d2c8b..654fc8de41 100644
--- a/web/src/routeTree.gen.ts
+++ b/web/src/routeTree.gen.ts
@@ -33,6 +33,7 @@ import { Route as AuthMfaRecoveryRouteImport } from './routes/auth/mfa/recovery'
 import { Route as AuthMfaEmailRouteImport } from './routes/auth/mfa/email'
 import { Route as WizardMigrationLocationsRouteImport } from './routes/_wizard/migration/locations'
 import { Route as AuthorizedWizardSetupEdgeRouteImport } from './routes/_authorized/_wizard/setup-edge'
+import { Route as AuthorizedWizardSettingsCoreCertificateRouteImport } from './routes/_authorized/_wizard/settings-core-certificate'
 import { Route as AuthorizedWizardAddLocationRouteImport } from './routes/_authorized/_wizard/add-location'
 import { Route as AuthorizedWizardAddExternalOpenidRouteImport } from './routes/_authorized/_wizard/add-external-openid'
 import { Route as AuthorizedDefaultWebhooksRouteImport } from './routes/_authorized/_default/webhooks'
@@ -191,6 +192,12 @@ const AuthorizedWizardSetupEdgeRoute =
     path: '/setup-edge',
     getParentRoute: () => AuthorizedRoute,
   } as any)
+const AuthorizedWizardSettingsCoreCertificateRoute =
+  AuthorizedWizardSettingsCoreCertificateRouteImport.update({
+    id: '/_wizard/settings-core-certificate',
+    path: '/settings-core-certificate',
+    getParentRoute: () => AuthorizedRoute,
+  } as any)
 const AuthorizedWizardAddLocationRoute =
   AuthorizedWizardAddLocationRouteImport.update({
     id: '/_wizard/add-location',
@@ -437,6 +444,7 @@ export interface FileRoutesByFullPath {
   '/webhooks': typeof AuthorizedDefaultWebhooksRoute
   '/add-external-openid': typeof AuthorizedWizardAddExternalOpenidRoute
   '/add-location': typeof AuthorizedWizardAddLocationRoute
+  '/settings-core-certificate': typeof AuthorizedWizardSettingsCoreCertificateRoute
   '/setup-edge': typeof AuthorizedWizardSetupEdgeRoute
   '/migration/locations': typeof WizardMigrationLocationsRoute
   '/auth/mfa/email': typeof AuthMfaEmailRoute
@@ -497,6 +505,7 @@ export interface FileRoutesByTo {
   '/webhooks': typeof AuthorizedDefaultWebhooksRoute
   '/add-external-openid': typeof AuthorizedWizardAddExternalOpenidRoute
   '/add-location': typeof AuthorizedWizardAddLocationRoute
+  '/settings-core-certificate': typeof AuthorizedWizardSettingsCoreCertificateRoute
   '/setup-edge': typeof AuthorizedWizardSetupEdgeRoute
   '/migration/locations': typeof WizardMigrationLocationsRoute
   '/auth/mfa/email': typeof AuthMfaEmailRoute
@@ -561,6 +570,7 @@ export interface FileRoutesById {
   '/_authorized/_default/webhooks': typeof AuthorizedDefaultWebhooksRoute
   '/_authorized/_wizard/add-external-openid': typeof AuthorizedWizardAddExternalOpenidRoute
   '/_authorized/_wizard/add-location': typeof AuthorizedWizardAddLocationRoute
+  '/_authorized/_wizard/settings-core-certificate': typeof AuthorizedWizardSettingsCoreCertificateRoute
   '/_authorized/_wizard/setup-edge': typeof AuthorizedWizardSetupEdgeRoute
   '/_wizard/migration/locations': typeof WizardMigrationLocationsRoute
   '/auth/mfa/email': typeof AuthMfaEmailRoute
@@ -624,6 +634,7 @@ export interface FileRouteTypes {
     | '/webhooks'
     | '/add-external-openid'
     | '/add-location'
+    | '/settings-core-certificate'
     | '/setup-edge'
     | '/migration/locations'
     | '/auth/mfa/email'
@@ -684,6 +695,7 @@ export interface FileRouteTypes {
     | '/webhooks'
     | '/add-external-openid'
     | '/add-location'
+    | '/settings-core-certificate'
     | '/setup-edge'
     | '/migration/locations'
     | '/auth/mfa/email'
@@ -747,6 +759,7 @@ export interface FileRouteTypes {
     | '/_authorized/_default/webhooks'
     | '/_authorized/_wizard/add-external-openid'
     | '/_authorized/_wizard/add-location'
+    | '/_authorized/_wizard/settings-core-certificate'
     | '/_authorized/_wizard/setup-edge'
     | '/_wizard/migration/locations'
     | '/auth/mfa/email'
@@ -967,6 +980,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AuthorizedWizardSetupEdgeRouteImport
       parentRoute: typeof AuthorizedRoute
     }
+    '/_authorized/_wizard/settings-core-certificate': {
+      id: '/_authorized/_wizard/settings-core-certificate'
+      path: '/settings-core-certificate'
+      fullPath: '/settings-core-certificate'
+      preLoaderRoute: typeof AuthorizedWizardSettingsCoreCertificateRouteImport
+      parentRoute: typeof AuthorizedRoute
+    }
     '/_authorized/_wizard/add-location': {
       id: '/_authorized/_wizard/add-location'
       path: '/add-location'
@@ -1322,6 +1342,7 @@ interface AuthorizedRouteChildren {
   AuthorizedPlaygroundRoute: typeof AuthorizedPlaygroundRoute
   AuthorizedWizardAddExternalOpenidRoute: typeof AuthorizedWizardAddExternalOpenidRoute
   AuthorizedWizardAddLocationRoute: typeof AuthorizedWizardAddLocationRoute
+  AuthorizedWizardSettingsCoreCertificateRoute: typeof AuthorizedWizardSettingsCoreCertificateRoute
   AuthorizedWizardSetupEdgeRoute: typeof AuthorizedWizardSetupEdgeRoute
 }
 
@@ -1331,6 +1352,8 @@ const AuthorizedRouteChildren: AuthorizedRouteChildren = {
   AuthorizedWizardAddExternalOpenidRoute:
     AuthorizedWizardAddExternalOpenidRoute,
   AuthorizedWizardAddLocationRoute: AuthorizedWizardAddLocationRoute,
+  AuthorizedWizardSettingsCoreCertificateRoute:
+    AuthorizedWizardSettingsCoreCertificateRoute,
   AuthorizedWizardSetupEdgeRoute: AuthorizedWizardSetupEdgeRoute,
 }
 
diff --git a/web/src/routes/_authorized/_wizard/settings-core-certificate.tsx b/web/src/routes/_authorized/_wizard/settings-core-certificate.tsx
new file mode 100644
index 0000000000..2aa4e80667
--- /dev/null
+++ b/web/src/routes/_authorized/_wizard/settings-core-certificate.tsx
@@ -0,0 +1,6 @@
+import { createFileRoute } from '@tanstack/react-router';
+import { SettingsCoreCertificateWizardPage } from '../../../pages/SettingsCoreCertificateWizardPage/SettingsCoreCertificateWizardPage';
+
+export const Route = createFileRoute('/_authorized/_wizard/settings-core-certificate')({
+  component: SettingsCoreCertificateWizardPage,
+});
diff --git a/web/src/shared/api/api.ts b/web/src/shared/api/api.ts
index 4e7c5a5b86..62bb02ec6d 100644
--- a/web/src/shared/api/api.ts
+++ b/web/src/shared/api/api.ts
@@ -95,6 +95,8 @@ import type {
   SetAutoAdoptionInternalUrlSettingsResponse,
   SetAutoAdoptionMfaSettingsRequest,
   SetAutoAdoptionVpnSettingsRequest,
+  SetCoreInternalUrlSettingsRequest,
+  SetCoreInternalUrlSettingsResponse,
   SetGeneralConfigRequest,
   Settings,
   SettingsEnterprise,
@@ -470,6 +472,11 @@ const api = {
       client.post('/core/cert/self-signed', data),
     certUpload: (data: { cert_pem: string; key_pem: string }) =>
       client.post('/core/cert/upload', data),
+    setInternalUrlSettings: (data: SetCoreInternalUrlSettingsRequest) =>
+      client.post<SetCoreInternalUrlSettingsResponse>(
+        '/core/cert/internal_url_settings',
+        data,
+      ),
     getCA: () => client.get<GetCAResponse>('/core/cert/ca'),
     getCerts: () => client.get<GetCertsResponse>('/core/cert/certs'),
   },
diff --git a/web/src/shared/api/types.ts b/web/src/shared/api/types.ts
index a4ed4bac9d..913244ada8 100644
--- a/web/src/shared/api/types.ts
+++ b/web/src/shared/api/types.ts
@@ -127,6 +127,16 @@ export interface SetAutoAdoptionInternalUrlSettingsResponse {
   cert_info: CertInfo | null;
 }
 
+export interface SetCoreInternalUrlSettingsRequest {
+  ssl_type: InternalSslType;
+  cert_pem?: string;
+  key_pem?: string;
+}
+
+export interface SetCoreInternalUrlSettingsResponse {
+  cert_info: CertInfo | null;
+}
+
 export interface SetAutoAdoptionExternalUrlSettingsRequest {
   public_proxy_url: string;
   ssl_type: ExternalSslType;
diff --git a/web/src/shared/components/certificates/InternalSslResult/InternalSslResult.tsx b/web/src/shared/components/certificates/InternalSslResult/InternalSslResult.tsx
new file mode 100644
index 0000000000..9d93687e66
--- /dev/null
+++ b/web/src/shared/components/certificates/InternalSslResult/InternalSslResult.tsx
@@ -0,0 +1,104 @@
+import { m } from '../../../../paraglide/messages';
+import type { CertInfo, InternalSslType } from '../../../api/types';
+import { Button } from '../../../defguard-ui/components/Button/Button';
+import { Divider } from '../../../defguard-ui/components/Divider/Divider';
+
+type Props = {
+  sslType: InternalSslType | null;
+  certInfo: CertInfo | null;
+  caCertPem?: string | null;
+  onDownloadCaCert: () => void;
+  imageSrc: string;
+};
+
+export const InternalSslResult = ({
+  sslType,
+  certInfo,
+  caCertPem,
+  onDownloadCaCert,
+  imageSrc,
+}: Props) => {
+  if (sslType === 'none') {
+    return (
+      <div className="ssl-result-card">
+        <div className="ssl-result-card-header">
+          <h3 className="green">
+            {m.initial_setup_auto_adoption_internal_url_ssl_no_ssl_title()}
+          </h3>
+          <p>{m.initial_setup_auto_adoption_internal_url_ssl_no_ssl_description()}</p>
+        </div>
+        <Divider />
+        <ul className="ssl-port-list">
+          <li>{m.initial_setup_auto_adoption_internal_url_ssl_no_ssl_port()}</li>
+        </ul>
+      </div>
+    );
+  }
+
+  if (sslType === 'defguard_ca') {
+    return (
+      <div className="ssl-result-validated-card">
+        <div className="ssl-result-validated-card-illustration">
+          <img src={imageSrc} loading="lazy" alt="" />
+        </div>
+        <div className="ssl-result-validated-card-content">
+          <div className="ssl-result-card-header">
+            <h3>{m.initial_setup_auto_adoption_internal_url_ssl_ca_title()}</h3>
+            <p>{m.initial_setup_auto_adoption_internal_url_ssl_ca_description()}</p>
+          </div>
+          <div>
+            <Button
+              text={m.initial_setup_auto_adoption_internal_url_ssl_ca_download()}
+              variant="outlined"
+              iconLeft="download"
+              onClick={onDownloadCaCert}
+              disabled={!caCertPem}
+            />
+          </div>
+        </div>
+      </div>
+    );
+  }
+
+  if (sslType === 'own_cert' && certInfo) {
+    return (
+      <div className="ssl-result-validated-card">
+        <div className="ssl-result-validated-card-illustration">
+          <img src={imageSrc} loading="lazy" alt="" />
+        </div>
+        <div className="ssl-result-validated-card-content">
+          <div className="ssl-result-card-header">
+            <h3>{m.initial_setup_auto_adoption_internal_url_ssl_own_title()}</h3>
+            <p>{m.initial_setup_auto_adoption_internal_url_ssl_own_description()}</p>
+          </div>
+          <div className="ssl-result-validated-card-info">
+            <p className="ssl-result-card-info-title">
+              {m.initial_setup_auto_adoption_internal_url_ssl_own_info_title()}
+            </p>
+            <Divider />
+            <div className="ssl-result-card-table">
+              <div className="ssl-result-card-table-row">
+                <span className="label">
+                  {m.initial_setup_auto_adoption_internal_url_ssl_own_common_name()}
+                </span>
+                <span className="value">{certInfo.common_name}</span>
+              </div>
+              <div className="ssl-result-card-table-row">
+                <span className="label">
+                  {m.initial_setup_auto_adoption_internal_url_ssl_own_validity()}
+                </span>
+                <span className="value">
+                  {m.initial_setup_auto_adoption_internal_url_ssl_own_validity_days({
+                    days: certInfo.valid_for_days,
+                  })}
+                </span>
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+    );
+  }
+
+  return null;
+};

From e50983100d6bdbcf79c033ecc5f1c32c0aba9a9e Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Thu, 2 Apr 2026 14:10:22 +0200
Subject: [PATCH 18/29] edge cert settings wizard backend

---
 .../defguard_core/src/handlers/core_certs.rs  | 181 +++++++++++++++++-
 crates/defguard_core/src/lib.rs               |  12 +-
 .../tests/integration/api/proxy_certs.rs      | 114 ++++++++++-
 .../src/handlers/auto_wizard.rs               | 136 ++-----------
 4 files changed, 312 insertions(+), 131 deletions(-)

diff --git a/crates/defguard_core/src/handlers/core_certs.rs b/crates/defguard_core/src/handlers/core_certs.rs
index 7da5608a24..6bfefd52cb 100644
--- a/crates/defguard_core/src/handlers/core_certs.rs
+++ b/crates/defguard_core/src/handlers/core_certs.rs
@@ -3,7 +3,9 @@ use defguard_certs::{
     CertificateAuthority, CertificateInfo, Csr, DnType, PemLabel, der_to_pem,
     generate_key_pair, parse_pem_certificate,
 };
-use defguard_common::db::models::{Certificates, CoreCertSource, settings::update_current_settings};
+use defguard_common::db::models::{
+    Certificates, CoreCertSource, ProxyCertSource, settings::update_current_settings,
+};
 use serde_json::json;
 use sqlx::PgPool;
 use utoipa::ToSchema;
@@ -42,6 +44,28 @@ pub struct CertInfoResponse {
     pub not_after: String,
 }
 
+/// SSL configuration type for the external (proxy) web server.
+#[derive(Default, Serialize, Deserialize, Debug, Clone, PartialEq, ToSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum ExternalSslType {
+    /// No SSL - plain HTTP, user manages reverse proxy / SSL termination themselves.
+    #[default]
+    None,
+    /// Obtain a certificate via ACME / Let's Encrypt.
+    LetsEncrypt,
+    /// Generate certificates using Defguard's internal Certificate Authority.
+    DefguardCa,
+    /// Upload a custom certificate and private key.
+    OwnCert,
+}
+
+#[derive(Serialize, Deserialize, Debug, ToSchema)]
+pub struct ExternalUrlSettingsConfig {
+    pub ssl_type: ExternalSslType,
+    pub cert_pem: Option<String>,
+    pub key_pem: Option<String>,
+}
+
 /// Core logic for applying internal URL certificate settings using the current Defguard URL.
 /// Returns cert info if a certificate was generated/uploaded, `None` for `ssl_type = None`.
 pub async fn apply_internal_url_settings(
@@ -146,6 +170,132 @@ pub async fn apply_internal_url_settings(
     Ok(cert_info)
 }
 
+/// Core logic for applying external URL certificate settings using the current public proxy URL.
+/// Returns cert info if a certificate was generated/uploaded, `None` otherwise.
+pub async fn apply_external_url_settings(
+    pool: &PgPool,
+    public_proxy_url: &str,
+    config: ExternalUrlSettingsConfig,
+) -> Result<Option<CertInfoResponse>, WebError> {
+    debug!(
+        "External URL certificate settings received: public_proxy_url={}, ssl_type={:?}",
+        public_proxy_url, config.ssl_type,
+    );
+
+    let mut certs = Certificates::get_or_default(pool)
+        .await
+        .map_err(WebError::from)?;
+
+    let hostname = if matches!(config.ssl_type, ExternalSslType::LetsEncrypt | ExternalSslType::DefguardCa)
+    {
+        let url = public_proxy_url.trim();
+        if url.is_empty() {
+            return Err(WebError::BadRequest(
+                "Public proxy URL is not configured".to_string(),
+            ));
+        }
+
+        reqwest::Url::parse(url)
+            .ok()
+            .and_then(|u| u.host_str().map(ToString::to_string))
+            .filter(|host| !host.is_empty())
+            .unwrap_or_else(|| url.to_string())
+    } else {
+        String::new()
+    };
+
+    let cert_info = match config.ssl_type {
+        ExternalSslType::None => {
+            certs.proxy_http_cert_source = ProxyCertSource::None;
+            certs.acme_domain = None;
+            certs.acme_account_credentials = None;
+            certs.proxy_http_cert_pem = None;
+            certs.proxy_http_cert_key_pem = None;
+            certs.proxy_http_cert_expiry = None;
+            certs.save(pool).await.map_err(WebError::from)?;
+            None
+        }
+        ExternalSslType::LetsEncrypt => {
+            certs.proxy_http_cert_source = ProxyCertSource::LetsEncrypt;
+            certs.acme_domain = Some(hostname);
+            certs.proxy_http_cert_pem = None;
+            certs.proxy_http_cert_key_pem = None;
+            certs.proxy_http_cert_expiry = None;
+            certs.save(pool).await.map_err(WebError::from)?;
+            None
+        }
+        ExternalSslType::DefguardCa => {
+            if certs.ca_cert_der.is_none() {
+                return Err(WebError::BadRequest(
+                    "CA certificate is not present; generate a CA first".to_string(),
+                ));
+            }
+
+            let ca_cert_der = certs.ca_cert_der.as_ref().expect("CA cert must be present");
+            let ca_key_der = certs.ca_key_der.as_ref().ok_or_else(|| {
+                WebError::BadRequest("CA private key not available for signing".to_string())
+            })?;
+
+            let ca = CertificateAuthority::from_cert_der_key_pair(ca_cert_der, ca_key_der)?;
+            let key_pair = generate_key_pair()?;
+            let san = vec![hostname.clone()];
+            let dn = vec![(DnType::CommonName, hostname.as_str())];
+            let csr = Csr::new(&key_pair, &san, dn)?;
+            let server_cert = ca.sign_csr(&csr)?;
+
+            let cert_der = server_cert.der().to_vec();
+            let cert_pem = der_to_pem(&cert_der, PemLabel::Certificate)?;
+            let key_pem = der_to_pem(key_pair.serialize_der().as_slice(), PemLabel::PrivateKey)?;
+            let info = CertificateInfo::from_der(&cert_der)?;
+            let valid_for_days = (info.not_after.and_utc() - chrono::Utc::now()).num_days();
+            let expiry = info.not_after;
+
+            certs.proxy_http_cert_source = ProxyCertSource::SelfSigned;
+            certs.acme_domain = None;
+            certs.proxy_http_cert_pem = Some(cert_pem);
+            certs.proxy_http_cert_key_pem = Some(key_pem);
+            certs.proxy_http_cert_expiry = Some(expiry);
+            certs.save(pool).await.map_err(WebError::from)?;
+
+            Some(CertInfoResponse {
+                common_name: info.subject_common_name,
+                valid_for_days,
+                not_before: info.not_before.to_string(),
+                not_after: info.not_after.to_string(),
+            })
+        }
+        ExternalSslType::OwnCert => {
+            let cert_pem_str = config.cert_pem.ok_or_else(|| {
+                WebError::BadRequest("cert_pem is required for own_cert".to_string())
+            })?;
+            let key_pem_str = config.key_pem.ok_or_else(|| {
+                WebError::BadRequest("key_pem is required for own_cert".to_string())
+            })?;
+
+            let cert_der = parse_pem_certificate(&cert_pem_str)?;
+            let info = CertificateInfo::from_der(cert_der.as_ref())?;
+            let valid_for_days = (info.not_after.and_utc() - chrono::Utc::now()).num_days();
+            let expiry = info.not_after;
+
+            certs.proxy_http_cert_source = ProxyCertSource::Custom;
+            certs.acme_domain = None;
+            certs.proxy_http_cert_pem = Some(cert_pem_str);
+            certs.proxy_http_cert_key_pem = Some(key_pem_str);
+            certs.proxy_http_cert_expiry = Some(expiry);
+            certs.save(pool).await.map_err(WebError::from)?;
+
+            Some(CertInfoResponse {
+                common_name: info.subject_common_name,
+                valid_for_days,
+                not_before: info.not_before.to_string(),
+                not_after: info.not_after.to_string(),
+            })
+        }
+    };
+
+    Ok(cert_info)
+}
+
 /// Upload a custom PEM certificate + private key for core HTTPS.
 #[derive(Serialize, Deserialize, ToSchema)]
 pub struct CoreCustomCertUpload {
@@ -326,6 +476,35 @@ pub(crate) async fn set_internal_url_settings(
     ))
 }
 
+#[utoipa::path(
+    post,
+    path = "/api/v1/proxy/cert/external_url_settings",
+    request_body = ExternalUrlSettingsConfig,
+    responses(
+        (status = 201, description = "External URL certificate settings applied.", body = ApiResponse),
+        (status = 400, description = "Invalid request.", body = ApiResponse),
+        (status = 401, description = "Unauthorized.", body = ApiResponse),
+        (status = 403, description = "Forbidden.", body = ApiResponse),
+        (status = 500, description = "Internal server error.", body = ApiResponse)
+    ),
+    security(("cookie" = []), ("api_token" = []))
+)]
+pub(crate) async fn set_external_url_settings(
+    _role: AdminRole,
+    Extension(pool): Extension<PgPool>,
+    Json(config): Json<ExternalUrlSettingsConfig>,
+) -> ApiResult {
+    info!("Applying proxy external URL certificate settings");
+    let settings = defguard_common::db::models::Settings::get_current_settings();
+    let cert_info = apply_external_url_settings(&pool, &settings.public_proxy_url, config).await?;
+    info!("Proxy external URL certificate settings applied");
+
+    Ok(ApiResponse::new(
+        json!({ "cert_info": cert_info }),
+        StatusCode::CREATED,
+    ))
+}
+
 #[utoipa::path(
     post,
     path = "/api/v1/core/cert/ca",
diff --git a/crates/defguard_core/src/lib.rs b/crates/defguard_core/src/lib.rs
index 90b869baac..5525f065f3 100644
--- a/crates/defguard_core/src/lib.rs
+++ b/crates/defguard_core/src/lib.rs
@@ -119,7 +119,7 @@ use crate::{
         component_setup::setup_gateway_tls_stream,
         core_certs::{
             core_cert_self_signed, core_cert_upload, get_ca, get_certs,
-            set_internal_url_settings,
+            set_external_url_settings, set_internal_url_settings,
         },
         forward_auth::forward_auth,
         gateway::{delete_gateway, gateway_details, gateway_list, update_gateway},
@@ -385,12 +385,16 @@ pub fn build_webapp(
             )
             .route("/proxy/cert/upload", post(proxy_cert_upload))
             .route("/proxy/cert/self-signed", post(proxy_cert_self_signed))
+            .route(
+                "/proxy/cert/external_url_settings",
+                post(set_external_url_settings),
+            )
             // Core HTTPS cert routes
             .route("/core/cert/upload", post(core_cert_upload))
             .route("/core/cert/self-signed", post(core_cert_self_signed))
-			.route("/core/cert/internal_url_settings", post(set_internal_url_settings))
-			.route("/core/cert/ca", get(get_ca))
-			.route("/core/cert/certs", get(get_certs))
+            .route("/core/cert/internal_url_settings", post(set_internal_url_settings))
+            .route("/core/cert/ca", get(get_ca))
+            .route("/core/cert/certs", get(get_certs))
             // Gateway routes
             .route("/gateway", get(gateway_list))
             .route(
diff --git a/crates/defguard_core/tests/integration/api/proxy_certs.rs b/crates/defguard_core/tests/integration/api/proxy_certs.rs
index 147c211d84..56a21317ac 100644
--- a/crates/defguard_core/tests/integration/api/proxy_certs.rs
+++ b/crates/defguard_core/tests/integration/api/proxy_certs.rs
@@ -12,11 +12,14 @@ use std::{
 };
 
 use axum_extra::extract::cookie::Key;
-use defguard_certs::CertificateAuthority;
+use defguard_certs::{CertificateAuthority, Csr, DnType, PemLabel, der_to_pem, generate_key_pair};
 use defguard_common::{
     VERSION,
     db::{
-        models::{Certificates, ProxyCertSource, Settings, settings::initialize_current_settings},
+        models::{
+            Certificates, ProxyCertSource, Settings,
+            settings::{initialize_current_settings, update_current_settings},
+        },
         setup_pool,
     },
     types::proxy::ProxyControlMessage,
@@ -152,6 +155,18 @@ async fn seed_ca(pool: &PgPool) {
     certs.save(pool).await.unwrap();
 }
 
+fn generate_test_cert_pem(common_name: &str) -> (String, String) {
+    let ca = CertificateAuthority::new("Test CA", "test@example.com", 365).unwrap();
+    let key_pair = generate_key_pair().unwrap();
+    let san = vec![common_name.to_string()];
+    let dn = vec![(DnType::CommonName, common_name)];
+    let csr = Csr::new(&key_pair, &san, dn).unwrap();
+    let cert = ca.sign_csr(&csr).unwrap();
+    let cert_pem = der_to_pem(cert.der(), PemLabel::Certificate).unwrap();
+    let key_pem = der_to_pem(key_pair.serialize_der().as_slice(), PemLabel::PrivateKey).unwrap();
+    (cert_pem, key_pem)
+}
+
 /// Authenticate as admin and discard the login event from the capture queue.
 async fn login_admin(client: &mut TestClient) {
     let auth = Auth::new("admin", "pass123");
@@ -478,3 +493,98 @@ async fn test_proxy_cert_pair_none_by_default(_: PgPoolOptions, opts: PgConnectO
         "No cert must be configured by default"
     );
 }
+
+#[sqlx::test]
+async fn test_external_url_settings_endpoint(_: PgPoolOptions, opts: PgConnectOptions) {
+    let pool = setup_pool(opts).await;
+    let (mut client, _capture, pool) = make_test_client_with_proxy_rx(pool).await;
+    login_admin(&mut client).await;
+
+    let mut settings = Settings::get_current_settings();
+    settings.public_proxy_url = "https://edge.example.com".into();
+    update_current_settings(&pool, settings).await.unwrap();
+
+    let response = client
+        .post("/api/v1/proxy/cert/external_url_settings")
+        .json(&json!({ "ssl_type": "none" }))
+        .send()
+        .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    let saved = Certificates::get(&pool).await.unwrap().unwrap();
+    assert_eq!(saved.proxy_http_cert_source, ProxyCertSource::None);
+    assert!(saved.proxy_http_cert_pem.is_none());
+    assert!(saved.proxy_http_cert_key_pem.is_none());
+    assert!(saved.proxy_http_cert_expiry.is_none());
+    assert!(saved.acme_domain.is_none());
+
+    let response = client
+        .post("/api/v1/proxy/cert/external_url_settings")
+        .json(&json!({ "ssl_type": "lets_encrypt" }))
+        .send()
+        .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    let body: serde_json::Value = response.json().await;
+    assert!(body["cert_info"].is_null());
+
+    let saved = Certificates::get(&pool).await.unwrap().unwrap();
+    assert_eq!(saved.proxy_http_cert_source, ProxyCertSource::LetsEncrypt);
+    assert_eq!(saved.acme_domain.as_deref(), Some("edge.example.com"));
+    assert!(saved.proxy_http_cert_pem.is_none());
+
+    seed_ca(&pool).await;
+
+    let response = client
+        .post("/api/v1/proxy/cert/external_url_settings")
+        .json(&json!({ "ssl_type": "defguard_ca" }))
+        .send()
+        .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    let body: serde_json::Value = response.json().await;
+    assert!(!body["cert_info"].is_null());
+    assert_eq!(body["cert_info"]["common_name"], "edge.example.com");
+
+    let saved = Certificates::get(&pool).await.unwrap().unwrap();
+    assert_eq!(saved.proxy_http_cert_source, ProxyCertSource::SelfSigned);
+    assert!(saved.proxy_http_cert_expiry.is_some());
+    assert!(
+        saved
+            .proxy_http_cert_pem
+            .as_deref()
+            .unwrap_or("")
+            .contains("BEGIN CERTIFICATE")
+    );
+    assert!(saved.acme_domain.is_none());
+
+    let (cert_pem, key_pem) = generate_test_cert_pem("uploaded-edge.example.com");
+    let response = client
+        .post("/api/v1/proxy/cert/external_url_settings")
+        .json(&json!({
+            "ssl_type": "own_cert",
+            "cert_pem": cert_pem,
+            "key_pem": key_pem
+        }))
+        .send()
+        .await;
+    assert_eq!(response.status(), StatusCode::CREATED);
+
+    let body: serde_json::Value = response.json().await;
+    assert_eq!(body["cert_info"]["common_name"], "uploaded-edge.example.com");
+
+    let saved = Certificates::get(&pool).await.unwrap().unwrap();
+    assert_eq!(saved.proxy_http_cert_source, ProxyCertSource::Custom);
+    assert!(saved.proxy_http_cert_expiry.is_some());
+    assert!(saved.acme_domain.is_none());
+
+    let response = client
+        .post("/api/v1/proxy/cert/external_url_settings")
+        .json(&json!({
+            "ssl_type": "own_cert",
+            "cert_pem": "-----BEGIN CERTIFICATE-----\nfake\n-----END CERTIFICATE-----\n"
+        }))
+        .send()
+        .await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+}
diff --git a/crates/defguard_setup/src/handlers/auto_wizard.rs b/crates/defguard_setup/src/handlers/auto_wizard.rs
index fc3fda9a96..f5561aa89e 100644
--- a/crates/defguard_setup/src/handlers/auto_wizard.rs
+++ b/crates/defguard_setup/src/handlers/auto_wizard.rs
@@ -1,12 +1,8 @@
 use axum::{Extension, Json};
-use defguard_certs::{
-    CertificateAuthority, CertificateInfo, Csr, PemLabel, der_to_pem, generate_key_pair,
-    parse_pem_certificate,
-};
+use defguard_certs::{PemLabel, der_to_pem};
 use defguard_common::{
     db::models::{
         Certificates, WireguardNetwork,
-        certificates::ProxyCertSource,
         initial_setup_wizard::InitialSetupStep,
         settings::update_current_settings,
         setup_auto_adoption::{AutoAdoptionWizardState, AutoAdoptionWizardStep},
@@ -21,7 +17,6 @@ use defguard_core::{
     handlers::{ApiResponse, ApiResult, core_certs},
 };
 use reqwest::StatusCode;
-use rcgen::DnType;
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use sqlx::{PgPool, query_scalar};
@@ -139,19 +134,7 @@ pub async fn get_internal_ssl_info(
 }
 
 /// SSL configuration type for the external (proxy) web server.
-#[derive(Default, Deserialize, Serialize, Debug, Clone, PartialEq)]
-#[serde(rename_all = "snake_case")]
-pub enum ExternalSslType {
-    /// No SSL - plain HTTP, user manages reverse proxy / SSL termination themselves.
-    #[default]
-    None,
-    /// Obtain certificate via ACME / Let's Encrypt.
-    LetsEncrypt,
-    /// Generate certificate using Defguard's internal Certificate Authority.
-    DefguardCa,
-    /// Upload a custom certificate and private key.
-    OwnCert,
-}
+pub use core_certs::ExternalSslType;
 
 #[derive(Deserialize, Serialize, Debug)]
 pub struct ExternalUrlSettingsConfig {
@@ -198,115 +181,20 @@ pub(crate) async fn apply_external_url_settings(
     pool: &PgPool,
     config: ExternalUrlSettingsConfig,
 ) -> Result<Option<CertInfoResponse>, WebError> {
-    debug!(
-        "External URL settings received: public_proxy_url={}, ssl_type={:?}",
-        config.public_proxy_url, config.ssl_type,
-    );
-
     let mut settings = defguard_common::db::models::Settings::get_current_settings();
     settings.public_proxy_url = config.public_proxy_url.clone();
     update_current_settings(pool, settings).await?;
 
-    let mut certs = Certificates::get_or_default(pool)
-        .await
-        .map_err(WebError::from)?;
-
-    let cert_info = match config.ssl_type {
-        ExternalSslType::None => {
-            certs.proxy_http_cert_source = ProxyCertSource::None;
-            certs.proxy_http_cert_pem = None;
-            certs.proxy_http_cert_key_pem = None;
-            certs.proxy_http_cert_expiry = None;
-            certs.save(pool).await.map_err(WebError::from)?;
-            None
-        }
-        ExternalSslType::LetsEncrypt => {
-            let hostname = reqwest::Url::parse(&config.public_proxy_url)
-                .ok()
-                .and_then(|u| u.host_str().map(ToString::to_string))
-                .unwrap_or_else(|| config.public_proxy_url.clone());
-            certs.proxy_http_cert_source = ProxyCertSource::LetsEncrypt;
-            certs.acme_domain = Some(hostname);
-            certs.proxy_http_cert_pem = None;
-            certs.proxy_http_cert_key_pem = None;
-            certs.proxy_http_cert_expiry = None;
-            certs.save(pool).await.map_err(WebError::from)?;
-            None
-        }
-        ExternalSslType::DefguardCa => {
-            let hostname = reqwest::Url::parse(&config.public_proxy_url)
-                .ok()
-                .and_then(|u| u.host_str().map(ToString::to_string))
-                .unwrap_or_else(|| config.public_proxy_url.clone());
-
-            // CA must already be present at this point.
-            if certs.ca_cert_der.is_none() {
-                return Err(WebError::BadRequest(
-                    "CA certificate is not present; generate a CA first".to_string(),
-                ));
-            }
-
-            let ca_cert_der = certs.ca_cert_der.as_ref().expect("CA cert must be present");
-            let ca_key_der = certs.ca_key_der.as_ref().ok_or_else(|| {
-                WebError::BadRequest("CA private key not available for signing".to_string())
-            })?;
-
-            let ca = CertificateAuthority::from_cert_der_key_pair(ca_cert_der, ca_key_der)?;
-            let key_pair = generate_key_pair()?;
-            let san = vec![hostname.clone()];
-            let dn = vec![(DnType::CommonName, hostname.as_str())];
-            let csr = Csr::new(&key_pair, &san, dn)?;
-            let server_cert = ca.sign_csr(&csr)?;
-
-            let cert_der = server_cert.der().to_vec();
-            let cert_pem = der_to_pem(&cert_der, PemLabel::Certificate)?;
-            let key_pem = der_to_pem(key_pair.serialize_der().as_slice(), PemLabel::PrivateKey)?;
-            let info = CertificateInfo::from_der(&cert_der)?;
-            let valid_for_days = (info.not_after.and_utc() - chrono::Utc::now()).num_days();
-            let expiry = info.not_after;
-
-            certs.proxy_http_cert_source = ProxyCertSource::SelfSigned;
-            certs.proxy_http_cert_pem = Some(cert_pem);
-            certs.proxy_http_cert_key_pem = Some(key_pem);
-            certs.proxy_http_cert_expiry = Some(expiry);
-            certs.save(pool).await.map_err(WebError::from)?;
-
-            Some(CertInfoResponse {
-                common_name: info.subject_common_name,
-                valid_for_days,
-                not_before: info.not_before.to_string(),
-                not_after: info.not_after.to_string(),
-            })
-        }
-        ExternalSslType::OwnCert => {
-            let cert_pem_str = config.cert_pem.ok_or_else(|| {
-                WebError::BadRequest("cert_pem is required for own_cert".to_string())
-            })?;
-            let key_pem_str = config.key_pem.ok_or_else(|| {
-                WebError::BadRequest("key_pem is required for own_cert".to_string())
-            })?;
-
-            let cert_der = parse_pem_certificate(&cert_pem_str)?;
-            let info = CertificateInfo::from_der(cert_der.as_ref())?;
-            let valid_for_days = (info.not_after.and_utc() - chrono::Utc::now()).num_days();
-            let expiry = info.not_after;
-
-            certs.proxy_http_cert_source = ProxyCertSource::Custom;
-            certs.proxy_http_cert_pem = Some(cert_pem_str);
-            certs.proxy_http_cert_key_pem = Some(key_pem_str);
-            certs.proxy_http_cert_expiry = Some(expiry);
-            certs.save(pool).await.map_err(WebError::from)?;
-
-            Some(CertInfoResponse {
-                common_name: info.subject_common_name.clone(),
-                valid_for_days,
-                not_before: info.not_before.to_string(),
-                not_after: info.not_after.to_string(),
-            })
-        }
-    };
-
-    Ok(cert_info)
+    core_certs::apply_external_url_settings(
+        pool,
+        &config.public_proxy_url,
+        core_certs::ExternalUrlSettingsConfig {
+            ssl_type: config.ssl_type,
+            cert_pem: config.cert_pem,
+            key_pem: config.key_pem,
+        },
+    )
+    .await
 }
 
 /// Returns external SSL certificate info (for the "Download CA certificate" step).

From 0e48be68573a58618dcf771a26cdc80a09ceb9b8 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Thu, 2 Apr 2026 15:14:41 +0200
Subject: [PATCH 19/29] proxy certs settings

---
 web/messages/en/settings.json                 |  12 +
 .../SettingsEdgeCertificateWizardPage.tsx     |  68 ++++
 ...rtificateWizardExternalUrlSettingsStep.tsx | 171 +++++++++
 ...tificateWizardExternalUrlSslConfigStep.tsx | 325 ++++++++++++++++++
 ...ttingsEdgeCertificateWizardSummaryStep.tsx |  46 +++
 .../style.scss                                |  18 +
 .../types.ts                                  |   8 +
 .../useSettingsEdgeCertificateWizardStore.ts  |  51 +++
 .../SettingsCertificatesPage.tsx              |   4 +-
 web/src/routeTree.gen.ts                      |  23 ++
 .../_wizard/settings-edge-certificate.tsx     |   6 +
 web/src/shared/api/api.ts                     |   7 +
 web/src/shared/api/types.ts                   |  10 +
 13 files changed, 747 insertions(+), 2 deletions(-)
 create mode 100644 web/src/pages/SettingsEdgeCertificateWizardPage/SettingsEdgeCertificateWizardPage.tsx
 create mode 100644 web/src/pages/SettingsEdgeCertificateWizardPage/steps/SettingsEdgeCertificateWizardExternalUrlSettingsStep.tsx
 create mode 100644 web/src/pages/SettingsEdgeCertificateWizardPage/steps/SettingsEdgeCertificateWizardExternalUrlSslConfigStep.tsx
 create mode 100644 web/src/pages/SettingsEdgeCertificateWizardPage/steps/SettingsEdgeCertificateWizardSummaryStep.tsx
 create mode 100644 web/src/pages/SettingsEdgeCertificateWizardPage/style.scss
 create mode 100644 web/src/pages/SettingsEdgeCertificateWizardPage/types.ts
 create mode 100644 web/src/pages/SettingsEdgeCertificateWizardPage/useSettingsEdgeCertificateWizardStore.ts
 create mode 100644 web/src/routes/_authorized/_wizard/settings-edge-certificate.tsx

diff --git a/web/messages/en/settings.json b/web/messages/en/settings.json
index ffdc8e9136..adf9bf9e59 100644
--- a/web/messages/en/settings.json
+++ b/web/messages/en/settings.json
@@ -63,6 +63,18 @@
   "settings_certs_certs_custom_change": "Change/upload certificate",
   "settings_certs_certs_edge_title": "Edge certificate",
   "settings_certs_certs_edge_download": "Download Edge certificate",
+  "settings_certs_edge_wizard_title": "External URL Settings",
+  "settings_certs_edge_wizard_subtitle": "Reconfigure how Defguard secures the public Edge URL.",
+  "settings_certs_edge_wizard_step_external_url_settings_label": "External URL Settings",
+  "settings_certs_edge_wizard_step_external_url_settings_description": "Choose how SSL should be configured for the public Edge URL.",
+  "settings_certs_edge_wizard_step_external_url_ssl_config_label": "External URL SSL Configuration",
+  "settings_certs_edge_wizard_step_external_url_ssl_config_description": "Review the SSL configuration generated from your selected certificate type.",
+  "settings_certs_edge_wizard_step_summary_label": "Summary",
+  "settings_certs_edge_wizard_step_summary_description": "Review the result of the certificate configuration.",
+  "settings_certs_edge_wizard_summary_success_title": "Configuration succeeded",
+  "settings_certs_edge_wizard_summary_success_description": "Your Edge certificate settings have been saved successfully.",
+  "settings_certs_edge_wizard_summary_restart_required": "Restart the webserver to apply the new certificate.",
+  "settings_certs_edge_wizard_summary_ok": "OK",
   "settings_vpn_stats_toggle_title": "Stats purge",
   "settings_vpn_stats_label_purge_frequency": "Stats purge frequency",
   "settings_vpn_stats_helper_purge_frequency": "",
diff --git a/web/src/pages/SettingsEdgeCertificateWizardPage/SettingsEdgeCertificateWizardPage.tsx b/web/src/pages/SettingsEdgeCertificateWizardPage/SettingsEdgeCertificateWizardPage.tsx
new file mode 100644
index 0000000000..349110d0bf
--- /dev/null
+++ b/web/src/pages/SettingsEdgeCertificateWizardPage/SettingsEdgeCertificateWizardPage.tsx
@@ -0,0 +1,68 @@
+import { useNavigate } from '@tanstack/react-router';
+import { type ReactNode, useEffect, useMemo } from 'react';
+import { m } from '../../paraglide/messages';
+import type { WizardPageStep } from '../../shared/components/wizard/types';
+import { WizardPage } from '../../shared/components/wizard/WizardPage/WizardPage';
+import { SettingsEdgeCertificateWizardExternalUrlSettingsStep } from './steps/SettingsEdgeCertificateWizardExternalUrlSettingsStep';
+import { SettingsEdgeCertificateWizardExternalUrlSslConfigStep } from './steps/SettingsEdgeCertificateWizardExternalUrlSslConfigStep';
+import { SettingsEdgeCertificateWizardSummaryStep } from './steps/SettingsEdgeCertificateWizardSummaryStep';
+import {
+  SettingsEdgeCertificateWizardStep,
+  type SettingsEdgeCertificateWizardStepValue,
+} from './types';
+import { useSettingsEdgeCertificateWizardStore } from './useSettingsEdgeCertificateWizardStore';
+
+const steps: Record<SettingsEdgeCertificateWizardStepValue, ReactNode> = {
+  externalUrlSettings: <SettingsEdgeCertificateWizardExternalUrlSettingsStep />,
+  externalUrlSslConfig: <SettingsEdgeCertificateWizardExternalUrlSslConfigStep />,
+  summary: <SettingsEdgeCertificateWizardSummaryStep />,
+};
+
+export const SettingsEdgeCertificateWizardPage = () => {
+  const activeStep = useSettingsEdgeCertificateWizardStore((s) => s.activeStep);
+  const navigate = useNavigate();
+
+  useEffect(() => () => useSettingsEdgeCertificateWizardStore.getState().reset(), []);
+
+  const stepsConfig = useMemo(
+    (): Record<SettingsEdgeCertificateWizardStepValue, WizardPageStep> => ({
+      externalUrlSettings: {
+        id: SettingsEdgeCertificateWizardStep.ExternalUrlSettings,
+        order: 1,
+        label: m.settings_certs_edge_wizard_step_external_url_settings_label(),
+        description:
+          m.settings_certs_edge_wizard_step_external_url_settings_description(),
+      },
+      externalUrlSslConfig: {
+        id: SettingsEdgeCertificateWizardStep.ExternalUrlSslConfig,
+        order: 2,
+        label: m.settings_certs_edge_wizard_step_external_url_ssl_config_label(),
+        description:
+          m.settings_certs_edge_wizard_step_external_url_ssl_config_description(),
+      },
+      summary: {
+        id: SettingsEdgeCertificateWizardStep.Summary,
+        order: 3,
+        label: m.settings_certs_edge_wizard_step_summary_label(),
+        description: m.settings_certs_edge_wizard_step_summary_description(),
+      },
+    }),
+    [],
+  );
+
+  return (
+    <WizardPage
+      id="settings-edge-certificate-wizard"
+      activeStep={activeStep}
+      steps={stepsConfig}
+      title={m.settings_certs_edge_wizard_title()}
+      subtitle={m.settings_certs_edge_wizard_subtitle()}
+      onClose={() => {
+        useSettingsEdgeCertificateWizardStore.getState().reset();
+        void navigate({ to: '/settings/certs', replace: true });
+      }}
+    >
+      {steps[activeStep]}
+    </WizardPage>
+  );
+};
diff --git a/web/src/pages/SettingsEdgeCertificateWizardPage/steps/SettingsEdgeCertificateWizardExternalUrlSettingsStep.tsx b/web/src/pages/SettingsEdgeCertificateWizardPage/steps/SettingsEdgeCertificateWizardExternalUrlSettingsStep.tsx
new file mode 100644
index 0000000000..e920696383
--- /dev/null
+++ b/web/src/pages/SettingsEdgeCertificateWizardPage/steps/SettingsEdgeCertificateWizardExternalUrlSettingsStep.tsx
@@ -0,0 +1,171 @@
+import { useMutation } from '@tanstack/react-query';
+import z from 'zod';
+import { m } from '../../../paraglide/messages';
+import api from '../../../shared/api/api';
+import type { ExternalSslType } from '../../../shared/api/types';
+import { Controls } from '../../../shared/components/Controls/Controls';
+import { WizardCard } from '../../../shared/components/wizard/WizardCard/WizardCard';
+import { Button } from '../../../shared/defguard-ui/components/Button/Button';
+import { Divider } from '../../../shared/defguard-ui/components/Divider/Divider';
+import { Helper } from '../../../shared/defguard-ui/components/Helper/Helper';
+import { Radio } from '../../../shared/defguard-ui/components/Radio/Radio';
+import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
+import { Snackbar } from '../../../shared/defguard-ui/providers/snackbar/snackbar';
+import { ThemeSpacing } from '../../../shared/defguard-ui/types';
+import { useAppForm } from '../../../shared/form';
+import { formChangeLogic } from '../../../shared/formLogic';
+import '../../SetupPage/autoAdoption/steps/style.scss';
+import { SettingsEdgeCertificateWizardStep } from '../types';
+import { useSettingsEdgeCertificateWizardStore } from '../useSettingsEdgeCertificateWizardStore';
+
+export const SettingsEdgeCertificateWizardExternalUrlSettingsStep = () => {
+  const storedSslType = useSettingsEdgeCertificateWizardStore((s) => s.external_ssl_type);
+
+  const formSchema = z.object({
+    ssl_type: z.custom<ExternalSslType>(),
+    cert_pem_file: z.custom<File | null>().nullable(),
+    key_pem_file: z.custom<File | null>().nullable(),
+  });
+
+  const { mutate, isPending } = useMutation({
+    mutationFn: api.edge.setExternalUrlSettings,
+    meta: { invalidate: [['core', 'cert', 'certs']] },
+    onSuccess: (response) => {
+      useSettingsEdgeCertificateWizardStore.setState({
+        external_ssl_type: form.getFieldValue('ssl_type'),
+        external_ssl_cert_info: response.data.cert_info ?? null,
+        activeStep: SettingsEdgeCertificateWizardStep.ExternalUrlSslConfig,
+      });
+    },
+    onError: (error) => {
+      Snackbar.error(m.settings_msg_save_failed());
+      console.error('Failed to save edge external URL settings:', error);
+    },
+  });
+
+  const form = useAppForm({
+    defaultValues: {
+      ssl_type: (storedSslType ?? 'none') as ExternalSslType,
+      cert_pem_file: null as File | null,
+      key_pem_file: null as File | null,
+    },
+    validationLogic: formChangeLogic,
+    validators: { onSubmit: formSchema, onChange: formSchema },
+    onSubmit: async ({ value }) => {
+      if (
+        value.ssl_type === 'own_cert' &&
+        (!value.cert_pem_file || !value.key_pem_file)
+      ) {
+        Snackbar.error(
+          m.initial_setup_auto_adoption_external_url_settings_upload_files_required(),
+        );
+        return;
+      }
+
+      mutate({
+        ssl_type: value.ssl_type,
+        cert_pem: value.cert_pem_file ? await value.cert_pem_file.text() : undefined,
+        key_pem: value.key_pem_file ? await value.key_pem_file.text() : undefined,
+      });
+    },
+  });
+
+  return (
+    <WizardCard>
+      <form
+        onSubmit={(e) => {
+          e.stopPropagation();
+          e.preventDefault();
+          form.handleSubmit();
+        }}
+      >
+        <form.AppForm>
+          <p>{m.initial_setup_auto_adoption_external_url_settings_description()}</p>
+          <SizedBox height={ThemeSpacing.Xl} />
+          <form.Subscribe selector={(s) => s.values.ssl_type}>
+            {(sslType) => (
+              <div className="ssl-options">
+                <div className="ssl-option-row">
+                  <Radio
+                    text={m.initial_setup_auto_adoption_external_url_settings_ssl_option_none()}
+                    active={sslType === 'none'}
+                    onClick={() => form.setFieldValue('ssl_type', 'none')}
+                  />
+                  <Helper>
+                    {m.initial_setup_auto_adoption_external_url_settings_ssl_option_none_help()}
+                  </Helper>
+                </div>
+                <SizedBox height={ThemeSpacing.Md} />
+                <div className="ssl-option-row">
+                  <Radio
+                    text={m.initial_setup_auto_adoption_external_url_settings_ssl_option_lets_encrypt()}
+                    active={sslType === 'lets_encrypt'}
+                    onClick={() => form.setFieldValue('ssl_type', 'lets_encrypt')}
+                  />
+                  <Helper>
+                    {m.initial_setup_auto_adoption_external_url_settings_ssl_option_lets_encrypt_help()}
+                  </Helper>
+                </div>
+                <SizedBox height={ThemeSpacing.Md} />
+                <div className="ssl-option-row">
+                  <Radio
+                    text={m.initial_setup_auto_adoption_external_url_settings_ssl_option_defguard_ca()}
+                    active={sslType === 'defguard_ca'}
+                    onClick={() => form.setFieldValue('ssl_type', 'defguard_ca')}
+                  />
+                  <Helper>
+                    {m.initial_setup_auto_adoption_external_url_settings_ssl_option_defguard_ca_help()}
+                  </Helper>
+                </div>
+                <SizedBox height={ThemeSpacing.Md} />
+                <div className="ssl-option-row">
+                  <Radio
+                    text={m.initial_setup_auto_adoption_external_url_settings_ssl_option_own_cert()}
+                    active={sslType === 'own_cert'}
+                    onClick={() => form.setFieldValue('ssl_type', 'own_cert')}
+                  />
+                  <Helper>
+                    {m.initial_setup_auto_adoption_external_url_settings_ssl_option_own_cert_help()}
+                  </Helper>
+                </div>
+                {sslType === 'own_cert' && (
+                  <div className="cert-upload-section">
+                    <SizedBox height={ThemeSpacing.Xl} />
+                    <form.AppField name="cert_pem_file">
+                      {(field) => (
+                        <field.FormUploadField
+                          acceptedExtensions={['.pem', '.crt', '.cer']}
+                          title={m.initial_setup_auto_adoption_external_url_settings_upload_cert_button()}
+                        />
+                      )}
+                    </form.AppField>
+                    <SizedBox height={ThemeSpacing.Lg} />
+                    <form.AppField name="key_pem_file">
+                      {(field) => (
+                        <field.FormUploadField
+                          acceptedExtensions={['.pem', '.key']}
+                          title={m.initial_setup_auto_adoption_external_url_settings_upload_key_button()}
+                        />
+                      )}
+                    </form.AppField>
+                  </div>
+                )}
+              </div>
+            )}
+          </form.Subscribe>
+        </form.AppForm>
+      </form>
+      <SizedBox height={ThemeSpacing.Xl3} />
+      <Divider />
+      <Controls>
+        <div className="right">
+          <Button
+            text={m.controls_continue()}
+            onClick={form.handleSubmit}
+            loading={isPending}
+          />
+        </div>
+      </Controls>
+    </WizardCard>
+  );
+};
diff --git a/web/src/pages/SettingsEdgeCertificateWizardPage/steps/SettingsEdgeCertificateWizardExternalUrlSslConfigStep.tsx b/web/src/pages/SettingsEdgeCertificateWizardPage/steps/SettingsEdgeCertificateWizardExternalUrlSslConfigStep.tsx
new file mode 100644
index 0000000000..4468278e57
--- /dev/null
+++ b/web/src/pages/SettingsEdgeCertificateWizardPage/steps/SettingsEdgeCertificateWizardExternalUrlSslConfigStep.tsx
@@ -0,0 +1,325 @@
+import { useQuery } from '@tanstack/react-query';
+import { useCallback, useEffect, useState } from 'react';
+import { m } from '../../../paraglide/messages';
+import api from '../../../shared/api/api';
+import { Controls } from '../../../shared/components/Controls/Controls';
+import { LoadingStep } from '../../../shared/components/LoadingStep/LoadingStep';
+import { WizardCard } from '../../../shared/components/wizard/WizardCard/WizardCard';
+import { Button } from '../../../shared/defguard-ui/components/Button/Button';
+import { CodeCard } from '../../../shared/defguard-ui/components/CodeCard/CodeCard';
+import { Divider } from '../../../shared/defguard-ui/components/Divider/Divider';
+import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
+import { ThemeSpacing } from '../../../shared/defguard-ui/types';
+import { useSSEController } from '../../../shared/hooks/useSSEController';
+import { downloadFile } from '../../../shared/utils/download';
+import caIcon from '../../SetupPage/assets/ca.png';
+import '../../SetupPage/autoAdoption/steps/style.scss';
+import { SettingsEdgeCertificateWizardStep } from '../types';
+import { useSettingsEdgeCertificateWizardStore } from '../useSettingsEdgeCertificateWizardStore';
+
+type AcmeStepId =
+  | 'Connecting'
+  | 'CheckingDomain'
+  | 'ValidatingDomain'
+  | 'IssuingCertificate'
+  | 'Installing'
+  | 'Done';
+
+type AcmeEvent = {
+  step: AcmeStepId;
+  error: boolean;
+  message?: string;
+  logs?: string[];
+};
+
+type AcmeStepState = {
+  currentStep: AcmeStepId | null;
+  isComplete: boolean;
+  isProcessing: boolean;
+  errorMessage: string | null;
+  proxyLogs: string[];
+};
+
+const ACME_STEP_IDS: AcmeStepId[] = [
+  'CheckingDomain',
+  'Connecting',
+  'ValidatingDomain',
+  'IssuingCertificate',
+  'Installing',
+];
+
+const defaultAcmeState: AcmeStepState = {
+  currentStep: null,
+  isComplete: false,
+  isProcessing: false,
+  errorMessage: null,
+  proxyLogs: [],
+};
+
+export const SettingsEdgeCertificateWizardExternalUrlSslConfigStep = () => {
+  const sslType = useSettingsEdgeCertificateWizardStore((s) => s.external_ssl_type);
+  const certInfo = useSettingsEdgeCertificateWizardStore((s) => s.external_ssl_cert_info);
+
+  const [acmeState, setAcmeState] = useState<AcmeStepState>(defaultAcmeState);
+
+  const { data: sslInfoData } = useQuery({
+    queryKey: ['core', 'cert', 'ca'],
+    queryFn: api.core.getCA,
+    enabled: sslType === 'defguard_ca',
+    select: (response) => response.data,
+  });
+
+  const handleAcmeEvent = useCallback((event: AcmeEvent) => {
+    setAcmeState({
+      currentStep: event.step,
+      isComplete: event.step === 'Done',
+      isProcessing: event.step !== 'Done' && !event.error,
+      errorMessage: event.error
+        ? (event.message ??
+          m.initial_setup_auto_adoption_external_url_ssl_lets_encrypt_error_default())
+        : null,
+      proxyLogs: event.logs && event.logs.length > 0 ? [...event.logs] : [],
+    });
+  }, []);
+
+  const sse = useSSEController<AcmeEvent>(
+    '/api/v1/proxy/acme/stream',
+    {},
+    { onMessage: handleAcmeEvent },
+  );
+
+  useEffect(() => {
+    if (sslType !== 'lets_encrypt') return;
+    setAcmeState(defaultAcmeState);
+    sse.start();
+    return () => {
+      sse.stop();
+    };
+  }, [sslType, sse]);
+
+  useEffect(() => {
+    if (sslType === null) {
+      useSettingsEdgeCertificateWizardStore.setState({
+        activeStep: SettingsEdgeCertificateWizardStep.ExternalUrlSettings,
+      });
+    }
+  }, [sslType]);
+
+  const stepDone = useCallback(
+    (stepId: AcmeStepId): boolean => {
+      const stepIndex = ACME_STEP_IDS.indexOf(stepId);
+      const currentIndex = acmeState.currentStep
+        ? ACME_STEP_IDS.indexOf(acmeState.currentStep)
+        : -1;
+      return stepIndex < currentIndex || acmeState.isComplete;
+    },
+    [acmeState.isComplete, acmeState.currentStep],
+  );
+
+  const stepLoading = useCallback(
+    (stepId: AcmeStepId): boolean => {
+      return acmeState.isProcessing && acmeState.currentStep === stepId;
+    },
+    [acmeState.isProcessing, acmeState.currentStep],
+  );
+
+  const stepError = useCallback(
+    (stepId: AcmeStepId): string | null => {
+      if (acmeState.errorMessage && acmeState.currentStep === stepId) {
+        return acmeState.errorMessage;
+      }
+      return null;
+    },
+    [acmeState.errorMessage, acmeState.currentStep],
+  );
+
+  const handleDownloadCaCert = () => {
+    if (!sslInfoData?.ca_cert_pem) return;
+    downloadFile(
+      new Blob([sslInfoData.ca_cert_pem], { type: 'application/x-pem-file' }),
+      'defguard-ca',
+      'pem',
+    );
+  };
+
+  const renderContent = () => {
+    if (sslType === 'none') {
+      return (
+        <div className="ssl-result-card">
+          <div className="ssl-result-card-header">
+            <h3 className="green">
+              {m.initial_setup_auto_adoption_external_url_ssl_no_ssl_title()}
+            </h3>
+            <p>{m.initial_setup_auto_adoption_external_url_ssl_no_ssl_description()}</p>
+          </div>
+          <Divider />
+          <ul className="ssl-port-list">
+            <li>{m.initial_setup_auto_adoption_external_url_ssl_no_ssl_port()}</li>
+          </ul>
+        </div>
+      );
+    }
+
+    if (sslType === 'lets_encrypt') {
+      const steps: { id: AcmeStepId; title: string }[] = [
+        {
+          id: 'CheckingDomain',
+          title:
+            m.initial_setup_auto_adoption_external_url_ssl_lets_encrypt_checking_domain(),
+        },
+        {
+          id: 'Connecting',
+          title: m.initial_setup_auto_adoption_external_url_ssl_lets_encrypt_connecting(),
+        },
+        {
+          id: 'ValidatingDomain',
+          title: m.initial_setup_auto_adoption_external_url_ssl_lets_encrypt_validating(),
+        },
+        {
+          id: 'IssuingCertificate',
+          title: m.initial_setup_auto_adoption_external_url_ssl_lets_encrypt_issuing(),
+        },
+        {
+          id: 'Installing',
+          title: m.initial_setup_auto_adoption_external_url_ssl_lets_encrypt_installing(),
+        },
+      ];
+
+      return (
+        <div className="ssl-result-card">
+          <div>
+            {steps.map((step) => (
+              <LoadingStep
+                key={step.id}
+                title={step.title}
+                loading={stepLoading(step.id)}
+                success={stepDone(step.id)}
+                error={!!stepError(step.id)}
+                errorMessage={stepError(step.id) ?? undefined}
+              >
+                {acmeState.proxyLogs.length > 0 ? (
+                  <>
+                    <CodeCard
+                      title={m.initial_setup_auto_adoption_external_url_ssl_lets_encrypt_error_log_title()}
+                      value={acmeState.proxyLogs.join('\n')}
+                      copy
+                      download
+                    />
+                    <SizedBox height={ThemeSpacing.Xl} />
+                  </>
+                ) : null}
+                <Controls>
+                  <div className="left">
+                    <Button
+                      variant="primary"
+                      text={m.edge_setup_adoption_controls_retry()}
+                      onClick={() => {
+                        setAcmeState(defaultAcmeState);
+                        sse.restart();
+                      }}
+                      disabled={acmeState.isProcessing}
+                    />
+                  </div>
+                </Controls>
+              </LoadingStep>
+            ))}
+          </div>
+        </div>
+      );
+    }
+
+    if (sslType === 'defguard_ca') {
+      return (
+        <div className="ssl-result-validated-card">
+          <div className="ssl-result-validated-card-illustration">
+            <img src={caIcon} loading="lazy" alt="" />
+          </div>
+          <div className="ssl-result-validated-card-content gap-xl">
+            <div className="ssl-result-card-header">
+              <h3>{m.initial_setup_auto_adoption_external_url_ssl_ca_title()}</h3>
+              <p>{m.initial_setup_auto_adoption_external_url_ssl_ca_description()}</p>
+            </div>
+            <div>
+              <Button
+                text={m.initial_setup_auto_adoption_external_url_ssl_ca_download()}
+                variant="outlined"
+                iconLeft="download"
+                onClick={handleDownloadCaCert}
+                disabled={!sslInfoData?.ca_cert_pem}
+              />
+            </div>
+          </div>
+        </div>
+      );
+    }
+
+    if (sslType === 'own_cert' && certInfo) {
+      return (
+        <div className="ssl-result-validated-card">
+          <div className="ssl-result-validated-card-illustration">
+            <img src={caIcon} loading="lazy" alt="" />
+          </div>
+          <div className="ssl-result-validated-card-content">
+            <div className="ssl-result-card-header">
+              <h3>{m.initial_setup_auto_adoption_external_url_ssl_own_title()}</h3>
+              <p>{m.initial_setup_auto_adoption_external_url_ssl_own_description()}</p>
+            </div>
+            <div className="ssl-result-validated-card-info">
+              <p className="ssl-result-card-info-title">
+                {m.initial_setup_auto_adoption_external_url_ssl_own_info_title()}
+              </p>
+              <Divider />
+              <div className="ssl-result-card-table">
+                <div className="ssl-result-card-table-row">
+                  <span className="label">
+                    {m.initial_setup_auto_adoption_external_url_ssl_own_common_name()}
+                  </span>
+                  <span className="value">{certInfo.common_name}</span>
+                </div>
+                <div className="ssl-result-card-table-row">
+                  <span className="label">
+                    {m.initial_setup_auto_adoption_external_url_ssl_own_validity()}
+                  </span>
+                  <span className="value">
+                    {m.initial_setup_auto_adoption_external_url_ssl_own_validity_days({
+                      days: certInfo.valid_for_days,
+                    })}
+                  </span>
+                </div>
+              </div>
+            </div>
+          </div>
+        </div>
+      );
+    }
+
+    return null;
+  };
+
+  const isLetsEncryptProcessing = sslType === 'lets_encrypt' && acmeState.isProcessing;
+  const isLetsEncryptIncomplete =
+    sslType === 'lets_encrypt' && !acmeState.isComplete && !acmeState.errorMessage;
+
+  return (
+    <WizardCard>
+      {renderContent()}
+      <SizedBox height={ThemeSpacing.Xl3} />
+      <Divider />
+      <Controls>
+        <Button
+          text={m.controls_back()}
+          variant="outlined"
+          onClick={() => useSettingsEdgeCertificateWizardStore.getState().back()}
+          disabled={isLetsEncryptProcessing}
+        />
+        <div className="right">
+          <Button
+            text={m.controls_continue()}
+            onClick={() => useSettingsEdgeCertificateWizardStore.getState().next()}
+            disabled={isLetsEncryptProcessing || isLetsEncryptIncomplete}
+          />
+        </div>
+      </Controls>
+    </WizardCard>
+  );
+};
diff --git a/web/src/pages/SettingsEdgeCertificateWizardPage/steps/SettingsEdgeCertificateWizardSummaryStep.tsx b/web/src/pages/SettingsEdgeCertificateWizardPage/steps/SettingsEdgeCertificateWizardSummaryStep.tsx
new file mode 100644
index 0000000000..86fe1ede5e
--- /dev/null
+++ b/web/src/pages/SettingsEdgeCertificateWizardPage/steps/SettingsEdgeCertificateWizardSummaryStep.tsx
@@ -0,0 +1,46 @@
+import { useQueryClient } from '@tanstack/react-query';
+import { useNavigate } from '@tanstack/react-router';
+import { m } from '../../../paraglide/messages';
+import { Controls } from '../../../shared/components/Controls/Controls';
+import { WizardCard } from '../../../shared/components/wizard/WizardCard/WizardCard';
+import { Button } from '../../../shared/defguard-ui/components/Button/Button';
+import { Divider } from '../../../shared/defguard-ui/components/Divider/Divider';
+import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
+import { ThemeSpacing } from '../../../shared/defguard-ui/types';
+import { useSettingsEdgeCertificateWizardStore } from '../useSettingsEdgeCertificateWizardStore';
+import '../style.scss';
+
+export const SettingsEdgeCertificateWizardSummaryStep = () => {
+  const navigate = useNavigate();
+  const queryClient = useQueryClient();
+
+  const handleFinish = async () => {
+    await queryClient.invalidateQueries({ queryKey: ['core', 'cert', 'certs'] });
+    useSettingsEdgeCertificateWizardStore.getState().reset();
+    await navigate({ to: '/settings/certs' });
+  };
+
+  return (
+    <WizardCard className="settings-edge-certificate-summary-card">
+      <p className="summary-title">
+        {m.settings_certs_edge_wizard_summary_success_title()}
+      </p>
+      <SizedBox height={ThemeSpacing.Md} />
+      <p className="summary-description">
+        {m.settings_certs_edge_wizard_summary_success_description()}
+      </p>
+      <Divider spacing={ThemeSpacing.Xl} />
+      <p className="summary-restart">
+        {m.settings_certs_edge_wizard_summary_restart_required()}
+      </p>
+      <Controls>
+        <div className="right">
+          <Button
+            text={m.settings_certs_edge_wizard_summary_ok()}
+            onClick={handleFinish}
+          />
+        </div>
+      </Controls>
+    </WizardCard>
+  );
+};
diff --git a/web/src/pages/SettingsEdgeCertificateWizardPage/style.scss b/web/src/pages/SettingsEdgeCertificateWizardPage/style.scss
new file mode 100644
index 0000000000..6a6ed7981b
--- /dev/null
+++ b/web/src/pages/SettingsEdgeCertificateWizardPage/style.scss
@@ -0,0 +1,18 @@
+.settings-edge-certificate-summary-card {
+  .summary-title {
+    font: var(--t-title-h4);
+    color: var(--fg-neutral);
+    margin: 0;
+  }
+
+  .summary-description,
+  .summary-restart {
+    font: var(--t-body-primary-400);
+    color: var(--fg-neutral);
+    margin: 0;
+  }
+
+  .summary-restart {
+    color: var(--fg-faded);
+  }
+}
diff --git a/web/src/pages/SettingsEdgeCertificateWizardPage/types.ts b/web/src/pages/SettingsEdgeCertificateWizardPage/types.ts
new file mode 100644
index 0000000000..d90b2b775c
--- /dev/null
+++ b/web/src/pages/SettingsEdgeCertificateWizardPage/types.ts
@@ -0,0 +1,8 @@
+export const SettingsEdgeCertificateWizardStep = {
+  ExternalUrlSettings: 'externalUrlSettings',
+  ExternalUrlSslConfig: 'externalUrlSslConfig',
+  Summary: 'summary',
+} as const;
+
+export type SettingsEdgeCertificateWizardStepValue =
+  (typeof SettingsEdgeCertificateWizardStep)[keyof typeof SettingsEdgeCertificateWizardStep];
diff --git a/web/src/pages/SettingsEdgeCertificateWizardPage/useSettingsEdgeCertificateWizardStore.ts b/web/src/pages/SettingsEdgeCertificateWizardPage/useSettingsEdgeCertificateWizardStore.ts
new file mode 100644
index 0000000000..8dc123b113
--- /dev/null
+++ b/web/src/pages/SettingsEdgeCertificateWizardPage/useSettingsEdgeCertificateWizardStore.ts
@@ -0,0 +1,51 @@
+import { create } from 'zustand';
+import type { CertInfo, ExternalSslType } from '../../shared/api/types';
+import {
+  SettingsEdgeCertificateWizardStep,
+  type SettingsEdgeCertificateWizardStepValue,
+} from './types';
+
+type StoreValues = {
+  activeStep: SettingsEdgeCertificateWizardStepValue;
+  external_ssl_type: ExternalSslType | null;
+  external_ssl_cert_info: CertInfo | null;
+};
+
+type Store = StoreValues & {
+  setState: (values: Partial<StoreValues>) => void;
+  reset: () => void;
+  next: () => void;
+  back: () => void;
+};
+
+const defaults: StoreValues = {
+  activeStep: SettingsEdgeCertificateWizardStep.ExternalUrlSettings,
+  external_ssl_type: null,
+  external_ssl_cert_info: null,
+};
+
+export const useSettingsEdgeCertificateWizardStore = create<Store>()((set, get) => ({
+  ...defaults,
+  setState: (values) => set(values),
+  reset: () => set(defaults),
+  next: () => {
+    const activeStep = get().activeStep;
+    if (activeStep === SettingsEdgeCertificateWizardStep.ExternalUrlSettings) {
+      set({ activeStep: SettingsEdgeCertificateWizardStep.ExternalUrlSslConfig });
+      return;
+    }
+    if (activeStep === SettingsEdgeCertificateWizardStep.ExternalUrlSslConfig) {
+      set({ activeStep: SettingsEdgeCertificateWizardStep.Summary });
+    }
+  },
+  back: () => {
+    const activeStep = get().activeStep;
+    if (activeStep === SettingsEdgeCertificateWizardStep.Summary) {
+      set({ activeStep: SettingsEdgeCertificateWizardStep.ExternalUrlSslConfig });
+      return;
+    }
+    if (activeStep === SettingsEdgeCertificateWizardStep.ExternalUrlSslConfig) {
+      set({ activeStep: SettingsEdgeCertificateWizardStep.ExternalUrlSettings });
+    }
+  },
+}));
diff --git a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
index c916b7683e..ddd7f2e38a 100644
--- a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
+++ b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
@@ -139,7 +139,7 @@ const Content = () => {
             <Button
               variant="primary"
               text={m.settings_certs_certs_none_add_certificate()}
-              onClick={() => {}}
+              onClick={() => void navigate({ to: '/settings-edge-certificate' })}
               loading={false}
               disabled={false}
             />
@@ -169,7 +169,7 @@ const Content = () => {
             <Button
               variant="primary"
               text={m.settings_certs_certs_custom_change()}
-              onClick={() => {}}
+              onClick={() => void navigate({ to: '/settings-edge-certificate' })}
               loading={false}
               disabled={false}
             />
diff --git a/web/src/routeTree.gen.ts b/web/src/routeTree.gen.ts
index 654fc8de41..d23acb9139 100644
--- a/web/src/routeTree.gen.ts
+++ b/web/src/routeTree.gen.ts
@@ -33,6 +33,7 @@ import { Route as AuthMfaRecoveryRouteImport } from './routes/auth/mfa/recovery'
 import { Route as AuthMfaEmailRouteImport } from './routes/auth/mfa/email'
 import { Route as WizardMigrationLocationsRouteImport } from './routes/_wizard/migration/locations'
 import { Route as AuthorizedWizardSetupEdgeRouteImport } from './routes/_authorized/_wizard/setup-edge'
+import { Route as AuthorizedWizardSettingsEdgeCertificateRouteImport } from './routes/_authorized/_wizard/settings-edge-certificate'
 import { Route as AuthorizedWizardSettingsCoreCertificateRouteImport } from './routes/_authorized/_wizard/settings-core-certificate'
 import { Route as AuthorizedWizardAddLocationRouteImport } from './routes/_authorized/_wizard/add-location'
 import { Route as AuthorizedWizardAddExternalOpenidRouteImport } from './routes/_authorized/_wizard/add-external-openid'
@@ -192,6 +193,12 @@ const AuthorizedWizardSetupEdgeRoute =
     path: '/setup-edge',
     getParentRoute: () => AuthorizedRoute,
   } as any)
+const AuthorizedWizardSettingsEdgeCertificateRoute =
+  AuthorizedWizardSettingsEdgeCertificateRouteImport.update({
+    id: '/_wizard/settings-edge-certificate',
+    path: '/settings-edge-certificate',
+    getParentRoute: () => AuthorizedRoute,
+  } as any)
 const AuthorizedWizardSettingsCoreCertificateRoute =
   AuthorizedWizardSettingsCoreCertificateRouteImport.update({
     id: '/_wizard/settings-core-certificate',
@@ -445,6 +452,7 @@ export interface FileRoutesByFullPath {
   '/add-external-openid': typeof AuthorizedWizardAddExternalOpenidRoute
   '/add-location': typeof AuthorizedWizardAddLocationRoute
   '/settings-core-certificate': typeof AuthorizedWizardSettingsCoreCertificateRoute
+  '/settings-edge-certificate': typeof AuthorizedWizardSettingsEdgeCertificateRoute
   '/setup-edge': typeof AuthorizedWizardSetupEdgeRoute
   '/migration/locations': typeof WizardMigrationLocationsRoute
   '/auth/mfa/email': typeof AuthMfaEmailRoute
@@ -506,6 +514,7 @@ export interface FileRoutesByTo {
   '/add-external-openid': typeof AuthorizedWizardAddExternalOpenidRoute
   '/add-location': typeof AuthorizedWizardAddLocationRoute
   '/settings-core-certificate': typeof AuthorizedWizardSettingsCoreCertificateRoute
+  '/settings-edge-certificate': typeof AuthorizedWizardSettingsEdgeCertificateRoute
   '/setup-edge': typeof AuthorizedWizardSetupEdgeRoute
   '/migration/locations': typeof WizardMigrationLocationsRoute
   '/auth/mfa/email': typeof AuthMfaEmailRoute
@@ -571,6 +580,7 @@ export interface FileRoutesById {
   '/_authorized/_wizard/add-external-openid': typeof AuthorizedWizardAddExternalOpenidRoute
   '/_authorized/_wizard/add-location': typeof AuthorizedWizardAddLocationRoute
   '/_authorized/_wizard/settings-core-certificate': typeof AuthorizedWizardSettingsCoreCertificateRoute
+  '/_authorized/_wizard/settings-edge-certificate': typeof AuthorizedWizardSettingsEdgeCertificateRoute
   '/_authorized/_wizard/setup-edge': typeof AuthorizedWizardSetupEdgeRoute
   '/_wizard/migration/locations': typeof WizardMigrationLocationsRoute
   '/auth/mfa/email': typeof AuthMfaEmailRoute
@@ -635,6 +645,7 @@ export interface FileRouteTypes {
     | '/add-external-openid'
     | '/add-location'
     | '/settings-core-certificate'
+    | '/settings-edge-certificate'
     | '/setup-edge'
     | '/migration/locations'
     | '/auth/mfa/email'
@@ -696,6 +707,7 @@ export interface FileRouteTypes {
     | '/add-external-openid'
     | '/add-location'
     | '/settings-core-certificate'
+    | '/settings-edge-certificate'
     | '/setup-edge'
     | '/migration/locations'
     | '/auth/mfa/email'
@@ -760,6 +772,7 @@ export interface FileRouteTypes {
     | '/_authorized/_wizard/add-external-openid'
     | '/_authorized/_wizard/add-location'
     | '/_authorized/_wizard/settings-core-certificate'
+    | '/_authorized/_wizard/settings-edge-certificate'
     | '/_authorized/_wizard/setup-edge'
     | '/_wizard/migration/locations'
     | '/auth/mfa/email'
@@ -980,6 +993,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AuthorizedWizardSetupEdgeRouteImport
       parentRoute: typeof AuthorizedRoute
     }
+    '/_authorized/_wizard/settings-edge-certificate': {
+      id: '/_authorized/_wizard/settings-edge-certificate'
+      path: '/settings-edge-certificate'
+      fullPath: '/settings-edge-certificate'
+      preLoaderRoute: typeof AuthorizedWizardSettingsEdgeCertificateRouteImport
+      parentRoute: typeof AuthorizedRoute
+    }
     '/_authorized/_wizard/settings-core-certificate': {
       id: '/_authorized/_wizard/settings-core-certificate'
       path: '/settings-core-certificate'
@@ -1343,6 +1363,7 @@ interface AuthorizedRouteChildren {
   AuthorizedWizardAddExternalOpenidRoute: typeof AuthorizedWizardAddExternalOpenidRoute
   AuthorizedWizardAddLocationRoute: typeof AuthorizedWizardAddLocationRoute
   AuthorizedWizardSettingsCoreCertificateRoute: typeof AuthorizedWizardSettingsCoreCertificateRoute
+  AuthorizedWizardSettingsEdgeCertificateRoute: typeof AuthorizedWizardSettingsEdgeCertificateRoute
   AuthorizedWizardSetupEdgeRoute: typeof AuthorizedWizardSetupEdgeRoute
 }
 
@@ -1354,6 +1375,8 @@ const AuthorizedRouteChildren: AuthorizedRouteChildren = {
   AuthorizedWizardAddLocationRoute: AuthorizedWizardAddLocationRoute,
   AuthorizedWizardSettingsCoreCertificateRoute:
     AuthorizedWizardSettingsCoreCertificateRoute,
+  AuthorizedWizardSettingsEdgeCertificateRoute:
+    AuthorizedWizardSettingsEdgeCertificateRoute,
   AuthorizedWizardSetupEdgeRoute: AuthorizedWizardSetupEdgeRoute,
 }
 
diff --git a/web/src/routes/_authorized/_wizard/settings-edge-certificate.tsx b/web/src/routes/_authorized/_wizard/settings-edge-certificate.tsx
new file mode 100644
index 0000000000..a05af6bc1a
--- /dev/null
+++ b/web/src/routes/_authorized/_wizard/settings-edge-certificate.tsx
@@ -0,0 +1,6 @@
+import { createFileRoute } from '@tanstack/react-router';
+import { SettingsEdgeCertificateWizardPage } from '../../../pages/SettingsEdgeCertificateWizardPage/SettingsEdgeCertificateWizardPage';
+
+export const Route = createFileRoute('/_authorized/_wizard/settings-edge-certificate')({
+  component: SettingsEdgeCertificateWizardPage,
+});
diff --git a/web/src/shared/api/api.ts b/web/src/shared/api/api.ts
index 62bb02ec6d..292d869e5d 100644
--- a/web/src/shared/api/api.ts
+++ b/web/src/shared/api/api.ts
@@ -97,6 +97,8 @@ import type {
   SetAutoAdoptionVpnSettingsRequest,
   SetCoreInternalUrlSettingsRequest,
   SetCoreInternalUrlSettingsResponse,
+  SetEdgeExternalUrlSettingsRequest,
+  SetEdgeExternalUrlSettingsResponse,
   SetGeneralConfigRequest,
   Settings,
   SettingsEnterprise,
@@ -455,6 +457,11 @@ const api = {
     getEdge: (edgeId: number | string) => client.get<Edge>(`/proxy/${edgeId}`),
     editEdge: (data: Edge) => client.put(`/proxy/${data.id}`, data),
     deleteEdge: (edgeId: number | string) => client.delete(`/proxy/${edgeId}`),
+    setExternalUrlSettings: (data: SetEdgeExternalUrlSettingsRequest) =>
+      client.post<SetEdgeExternalUrlSettingsResponse>(
+        '/proxy/cert/external_url_settings',
+        data,
+      ),
   },
   gateway: {
     getGateways: () => client.get<GatewayInfo[]>('/gateway'),
diff --git a/web/src/shared/api/types.ts b/web/src/shared/api/types.ts
index 913244ada8..00e5a3d0c0 100644
--- a/web/src/shared/api/types.ts
+++ b/web/src/shared/api/types.ts
@@ -137,6 +137,16 @@ export interface SetCoreInternalUrlSettingsResponse {
   cert_info: CertInfo | null;
 }
 
+export interface SetEdgeExternalUrlSettingsRequest {
+  ssl_type: ExternalSslType;
+  cert_pem?: string;
+  key_pem?: string;
+}
+
+export interface SetEdgeExternalUrlSettingsResponse {
+  cert_info: CertInfo | null;
+}
+
 export interface SetAutoAdoptionExternalUrlSettingsRequest {
   public_proxy_url: string;
   ssl_type: ExternalSslType;

From 7a019830975096bf79d02a9d937e6d6ade18f2e0 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Fri, 3 Apr 2026 09:25:06 +0200
Subject: [PATCH 20/29] download CA cert

---
 .../defguard_core/src/handlers/core_certs.rs  | 18 ++++----
 web/messages/en/settings.json                 |  2 -
 .../SettingsCertificatesPage.tsx              | 42 +++++++++----------
 web/src/shared/api/types.ts                   |  2 -
 4 files changed, 27 insertions(+), 37 deletions(-)

diff --git a/crates/defguard_core/src/handlers/core_certs.rs b/crates/defguard_core/src/handlers/core_certs.rs
index 6bfefd52cb..9f41fd5914 100644
--- a/crates/defguard_core/src/handlers/core_certs.rs
+++ b/crates/defguard_core/src/handlers/core_certs.rs
@@ -569,14 +569,12 @@ pub(crate) async fn get_certs(_role: AdminRole, Extension(pool): Extension<PgPoo
         .await
         .map_err(WebError::from)?;
     Ok(ApiResponse::new(
-		json!({
-			"core_http_cert_pem": certs.core_http_cert_pem,
-			"core_http_cert_source": certs.core_http_cert_source,
-			"core_http_cert_expiry": certs.core_http_cert_expiry,
-			"proxy_http_cert_pem": certs.proxy_http_cert_pem,
-			"proxy_http_cert_source": certs.proxy_http_cert_source,
-			"proxy_http_cert_expiry": certs.proxy_http_cert_expiry,
-		}),
-		StatusCode::OK
-	))
+        json!({
+            "core_http_cert_source": certs.core_http_cert_source,
+            "core_http_cert_expiry": certs.core_http_cert_expiry,
+            "proxy_http_cert_source": certs.proxy_http_cert_source,
+            "proxy_http_cert_expiry": certs.proxy_http_cert_expiry,
+        }),
+        StatusCode::OK,
+    ))
 }
diff --git a/web/messages/en/settings.json b/web/messages/en/settings.json
index adf9bf9e59..3cd93e2fe2 100644
--- a/web/messages/en/settings.json
+++ b/web/messages/en/settings.json
@@ -40,7 +40,6 @@
   "settings_certs_certs_title": "Edge/Core Certificates",
   "settings_certs_certs_description": "Add and manage certificates issued outside of Defguard. Use them to integrate existing infrastructure and maintain secure connections with external systems and services.",
   "settings_certs_certs_core_title": "Core certificate",
-  "settings_certs_certs_core_download": "Download Core certificate",
   "settings_certs_core_wizard_title": "Internal URL Settings",
   "settings_certs_core_wizard_subtitle": "Reconfigure how Defguard secures the internal Core URL.",
   "settings_certs_core_wizard_step_internal_url_settings_label": "Internal URL Settings",
@@ -62,7 +61,6 @@
   "settings_certs_certs_custom_description": "You are using your own, custom SSL certificate.",
   "settings_certs_certs_custom_change": "Change/upload certificate",
   "settings_certs_certs_edge_title": "Edge certificate",
-  "settings_certs_certs_edge_download": "Download Edge certificate",
   "settings_certs_edge_wizard_title": "External URL Settings",
   "settings_certs_edge_wizard_subtitle": "Reconfigure how Defguard secures the public Edge URL.",
   "settings_certs_edge_wizard_step_external_url_settings_label": "External URL Settings",
diff --git a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
index ddd7f2e38a..13a050ea72 100644
--- a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
+++ b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
@@ -58,24 +58,20 @@ const Content = () => {
     queryFn: api.core.getCerts,
     select: (resp) => resp.data,
   });
+  const { data: caData, isFetching: isFetchingCa } = useQuery({
+    queryKey: ['core', 'cert', 'ca'],
+    queryFn: api.core.getCA,
+    select: (resp) => resp.data,
+  });
 
-  const downloadCoreCert = useCallback(() => {
-    const corePem = certsData?.core_http_cert_pem;
-    if (!isPresent(corePem)) return;
-    const blob = new Blob([corePem], {
-      type: 'application/x-pem-file;charset=utf-8',
-    });
-    downloadFile(blob, 'defguard-core', 'pem');
-  }, [certsData?.core_http_cert_pem]);
-
-  const downloadEdgeCert = useCallback(() => {
-    const edgePem = certsData?.proxy_http_cert_pem;
-    if (!isPresent(edgePem)) return;
-    const blob = new Blob([edgePem], {
+  const downloadCaCert = useCallback(() => {
+    const caPem = caData?.ca_cert_pem;
+    if (!isPresent(caPem)) return;
+    const blob = new Blob([caPem], {
       type: 'application/x-pem-file;charset=utf-8',
     });
-    downloadFile(blob, 'defguard-edge', 'pem');
-  }, [certsData?.proxy_http_cert_pem]);
+    downloadFile(blob, 'defguard-ca', 'pem');
+  }, [caData?.ca_cert_pem]);
 
   return (
     <>
@@ -104,10 +100,10 @@ const Content = () => {
             <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="outlined"
-              text={m.settings_certs_certs_core_download()}
-              onClick={downloadCoreCert}
-              loading={isFetching}
-              disabled={!isPresent(certsData?.core_http_cert_pem) || isFetching}
+              text={m.settings_certs_ca_download()}
+              onClick={downloadCaCert}
+              loading={isFetching || isFetchingCa}
+              disabled={!isPresent(caData?.ca_cert_pem) || isFetching || isFetchingCa}
             />
           </>
         )}
@@ -153,10 +149,10 @@ const Content = () => {
             <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="outlined"
-              text={m.settings_certs_certs_edge_download()}
-              onClick={downloadEdgeCert}
-              loading={isFetching}
-              disabled={!isPresent(certsData?.proxy_http_cert_pem) || isFetching}
+              text={m.settings_certs_ca_download()}
+              onClick={downloadCaCert}
+              loading={isFetching || isFetchingCa}
+              disabled={!isPresent(caData?.ca_cert_pem) || isFetching || isFetchingCa}
             />
           </>
         )}
diff --git a/web/src/shared/api/types.ts b/web/src/shared/api/types.ts
index 00e5a3d0c0..3824614fb8 100644
--- a/web/src/shared/api/types.ts
+++ b/web/src/shared/api/types.ts
@@ -69,10 +69,8 @@ export const EdgeCertSource = {
 export type EdgeCertSourceValue = (typeof EdgeCertSource)[keyof typeof EdgeCertSource];
 
 export interface GetCertsResponse {
-  core_http_cert_pem: string;
   core_http_cert_source: CoreCertSourceValue;
   core_http_cert_expiry: string;
-  proxy_http_cert_pem: string;
   proxy_http_cert_source: EdgeCertSourceValue;
   proxy_http_cert_expiry: string;
 }

From 043f9c51fdc0b614ed388448e64f104d5a2b5c22 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Fri, 3 Apr 2026 11:15:40 +0200
Subject: [PATCH 21/29] fix retry loop in letsencrypt flow

---
 ...ettingsEdgeCertificateWizardExternalUrlSslConfigStep.tsx | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/web/src/pages/SettingsEdgeCertificateWizardPage/steps/SettingsEdgeCertificateWizardExternalUrlSslConfigStep.tsx b/web/src/pages/SettingsEdgeCertificateWizardPage/steps/SettingsEdgeCertificateWizardExternalUrlSslConfigStep.tsx
index 4468278e57..9b53ac2dcb 100644
--- a/web/src/pages/SettingsEdgeCertificateWizardPage/steps/SettingsEdgeCertificateWizardExternalUrlSslConfigStep.tsx
+++ b/web/src/pages/SettingsEdgeCertificateWizardPage/steps/SettingsEdgeCertificateWizardExternalUrlSslConfigStep.tsx
@@ -88,6 +88,7 @@ export const SettingsEdgeCertificateWizardExternalUrlSslConfigStep = () => {
     { onMessage: handleAcmeEvent },
   );
 
+  // biome-ignore lint/correctness/useExhaustiveDependencies: only run on mount
   useEffect(() => {
     if (sslType !== 'lets_encrypt') return;
     setAcmeState(defaultAcmeState);
@@ -95,15 +96,16 @@ export const SettingsEdgeCertificateWizardExternalUrlSslConfigStep = () => {
     return () => {
       sse.stop();
     };
-  }, [sslType, sse]);
+  }, []);
 
+  // biome-ignore lint/correctness/useExhaustiveDependencies: only run on mount
   useEffect(() => {
     if (sslType === null) {
       useSettingsEdgeCertificateWizardStore.setState({
         activeStep: SettingsEdgeCertificateWizardStep.ExternalUrlSettings,
       });
     }
-  }, [sslType]);
+  }, []);
 
   const stepDone = useCallback(
     (stepId: AcmeStepId): boolean => {

From a588932b317784ab09fc9db28e2119cadd9bb687 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Fri, 3 Apr 2026 13:32:26 +0200
Subject: [PATCH 22/29] fix setting LE expiry; add cert info sections

---
 .../src/handlers/component_setup.rs           | 13 +++++
 .../defguard_core/src/handlers/core_certs.rs  |  8 ++++
 web/messages/en/settings.json                 |  5 +-
 .../SettingsCaPage/SettingsCaPage.tsx         |  2 +-
 .../SettingsCertificatesPage.tsx              | 47 +++++++++++++++++++
 .../SettingsCertificatesPage/style.scss       | 10 ++++
 web/src/shared/api/types.ts                   |  2 +
 7 files changed, 85 insertions(+), 2 deletions(-)
 create mode 100644 web/src/pages/settings/SettingsCertificatesPage/style.scss

diff --git a/crates/defguard_core/src/handlers/component_setup.rs b/crates/defguard_core/src/handlers/component_setup.rs
index ae557096b5..a9088b84ac 100644
--- a/crates/defguard_core/src/handlers/component_setup.rs
+++ b/crates/defguard_core/src/handlers/component_setup.rs
@@ -10,6 +10,7 @@ use axum::{
     extract::{Path, Query},
     response::sse::{Event, KeepAlive, Sse},
 };
+use chrono::NaiveDateTime;
 use defguard_certs::der_to_pem;
 use defguard_common::{
     VERSION,
@@ -1115,6 +1116,16 @@ fn acme_step_name(step: AcmeStep) -> &'static str {
     }
 }
 
+fn parse_cert_expiry(cert_pem: &str) -> Option<NaiveDateTime> {
+    let der = defguard_certs::parse_pem_certificate(cert_pem)
+        .map_err(|e| warn!("Failed to parse ACME cert PEM for expiry: {e}"))
+        .ok()?;
+    defguard_certs::CertificateInfo::from_der(&der)
+        .map(|info| info.not_after)
+        .map_err(|e| warn!("Failed to extract expiry from ACME cert: {e}"))
+        .ok()
+}
+
 /// Connects to the proxy's permanent `Proxy` gRPC service and calls `TriggerAcme`.
 ///
 /// Returns `(cert_pem, key_pem, account_credentials_json)` on success, or
@@ -1340,10 +1351,12 @@ pub async fn stream_proxy_acme(
         // Progress channel closed - collect the final result.
         match result_rx.await {
             Ok(Ok((cert_pem, key_pem, new_account_credentials_json))) => {
+                let acme_cert_expiry = parse_cert_expiry(&cert_pem);
                 match Certificates::get_or_default(&pool).await {
                     Ok(mut updated_certs) => {
                         updated_certs.proxy_http_cert_pem = Some(cert_pem.clone());
                         updated_certs.proxy_http_cert_key_pem = Some(key_pem.clone());
+                        updated_certs.proxy_http_cert_expiry = acme_cert_expiry;
                         updated_certs.acme_account_credentials =
                             Some(new_account_credentials_json);
                         updated_certs.proxy_http_cert_source =
diff --git a/crates/defguard_core/src/handlers/core_certs.rs b/crates/defguard_core/src/handlers/core_certs.rs
index 9f41fd5914..e98460f458 100644
--- a/crates/defguard_core/src/handlers/core_certs.rs
+++ b/crates/defguard_core/src/handlers/core_certs.rs
@@ -296,6 +296,12 @@ pub async fn apply_external_url_settings(
     Ok(cert_info)
 }
 
+fn cert_common_name(cert_pem: Option<&str>) -> Option<String> {
+    let cert_der = parse_pem_certificate(cert_pem?).ok()?;
+    let cert_info = CertificateInfo::from_der(cert_der.as_ref()).ok()?;
+    Some(cert_info.subject_common_name)
+}
+
 /// Upload a custom PEM certificate + private key for core HTTPS.
 #[derive(Serialize, Deserialize, ToSchema)]
 pub struct CoreCustomCertUpload {
@@ -572,8 +578,10 @@ pub(crate) async fn get_certs(_role: AdminRole, Extension(pool): Extension<PgPoo
         json!({
             "core_http_cert_source": certs.core_http_cert_source,
             "core_http_cert_expiry": certs.core_http_cert_expiry,
+            "core_http_cert_domain": cert_common_name(certs.core_http_cert_pem.as_deref()),
             "proxy_http_cert_source": certs.proxy_http_cert_source,
             "proxy_http_cert_expiry": certs.proxy_http_cert_expiry,
+            "proxy_http_cert_domain": cert_common_name(certs.proxy_http_cert_pem.as_deref()),
         }),
         StatusCode::OK,
     ))
diff --git a/web/messages/en/settings.json b/web/messages/en/settings.json
index 3cd93e2fe2..99d53d5f50 100644
--- a/web/messages/en/settings.json
+++ b/web/messages/en/settings.json
@@ -36,7 +36,8 @@
   "settings_certs_ca_information_extracted": "Information extracted from uploaded files",
   "settings_certs_ca_download": "Download CA certificate",
   "settings_certs_ca_email": "Email",
-  "settings_certs_ca_valid_until": "Valid until",
+  "settings_certs_valid_until": "Valid until",
+  "settings_certs_domain": "Certificate domain",
   "settings_certs_certs_title": "Edge/Core Certificates",
   "settings_certs_certs_description": "Add and manage certificates issued outside of Defguard. Use them to integrate existing infrastructure and maintain secure connections with external systems and services.",
   "settings_certs_certs_core_title": "Core certificate",
@@ -60,6 +61,8 @@
   "settings_certs_certs_custom_title": "Your own certificate",
   "settings_certs_certs_custom_description": "You are using your own, custom SSL certificate.",
   "settings_certs_certs_custom_change": "Change/upload certificate",
+  "settings_certs_certs_letsencrypt_title": "\"Let's Encrypt\"® certificate",
+  "settings_certs_certs_letsencrypt_description": "You are using a \"Let's Encrypt\"® issued certificate.",
   "settings_certs_certs_edge_title": "Edge certificate",
   "settings_certs_edge_wizard_title": "External URL Settings",
   "settings_certs_edge_wizard_subtitle": "Reconfigure how Defguard secures the public Edge URL.",
diff --git a/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx b/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
index 813724f177..928be6ae31 100644
--- a/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
+++ b/web/src/pages/settings/SettingsCaPage/SettingsCaPage.tsx
@@ -87,7 +87,7 @@ const Content = () => {
       <div className="ca-info-grid">
         <div className="ca-info-label">{m.settings_certs_ca_email()}</div>
         <div className="ca-info-value">{caData?.subject_email}</div>
-        <div className="ca-info-label">{m.settings_certs_ca_valid_until()}</div>
+        <div className="ca-info-label">{m.settings_certs_valid_until()}</div>
         <div className="ca-info-value">
           {caData?.ca_expiry ? displayDate(caData?.ca_expiry) : '-'}
         </div>
diff --git a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
index 13a050ea72..ebd85e5be9 100644
--- a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
+++ b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
@@ -1,3 +1,4 @@
+import './style.scss';
 import { useQuery } from '@tanstack/react-query';
 import { Link, useNavigate } from '@tanstack/react-router';
 import { useCallback } from 'react';
@@ -17,6 +18,7 @@ import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedB
 import { ThemeSpacing } from '../../../shared/defguard-ui/types';
 import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
 import { downloadFile } from '../../../shared/utils/download';
+import { displayDate } from '../../../shared/utils/displayDate';
 
 const breadcrumbs = [
   <Link
@@ -73,6 +75,7 @@ const Content = () => {
     downloadFile(blob, 'defguard-ca', 'pem');
   }, [caData?.ca_cert_pem]);
 
+  console.log(certsData);
   return (
     <>
       <MarkedSection icon="authorised-app">
@@ -98,6 +101,8 @@ const Content = () => {
               <p>{m.settings_certs_certs_internal_description()}</p>
             </DescriptionBlock>
             <SizedBox height={ThemeSpacing.Lg} />
+            <CertInfo validUntil={certsData.core_http_cert_expiry} domain={certsData.core_http_cert_domain}/>
+            <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="outlined"
               text={m.settings_certs_ca_download()}
@@ -113,6 +118,8 @@ const Content = () => {
               <p>{m.settings_certs_certs_custom_description()}</p>
             </DescriptionBlock>
             <SizedBox height={ThemeSpacing.Lg} />
+            <CertInfo validUntil={certsData.core_http_cert_expiry} domain={certsData.core_http_cert_domain}/>
+            <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="primary"
               text={m.settings_certs_certs_custom_change()}
@@ -147,6 +154,8 @@ const Content = () => {
               <p>{m.settings_certs_certs_internal_description()}</p>
             </DescriptionBlock>
             <SizedBox height={ThemeSpacing.Lg} />
+            <CertInfo validUntil={certsData.proxy_http_cert_expiry} domain={certsData.proxy_http_cert_domain}/>
+            <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="outlined"
               text={m.settings_certs_ca_download()}
@@ -162,6 +171,25 @@ const Content = () => {
               <p>{m.settings_certs_certs_custom_description()}</p>
             </DescriptionBlock>
             <SizedBox height={ThemeSpacing.Lg} />
+            <CertInfo validUntil={certsData.proxy_http_cert_expiry} domain={certsData.proxy_http_cert_domain}/>
+            <SizedBox height={ThemeSpacing.Lg} />
+            <Button
+              variant="primary"
+              text={m.settings_certs_certs_custom_change()}
+              onClick={() => void navigate({ to: '/settings-edge-certificate' })}
+              loading={false}
+              disabled={false}
+            />
+          </>
+        )}
+        {certsData?.proxy_http_cert_source === 'LetsEncrypt' && (
+          <>
+            <DescriptionBlock title={m.settings_certs_certs_letsencrypt_title()}>
+              <p>{m.settings_certs_certs_letsencrypt_description()}</p>
+            </DescriptionBlock>
+            <SizedBox height={ThemeSpacing.Lg} />
+            <CertInfo validUntil={certsData.proxy_http_cert_expiry} domain={certsData.proxy_http_cert_domain}/>
+            <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="primary"
               text={m.settings_certs_certs_custom_change()}
@@ -175,3 +203,22 @@ const Content = () => {
     </>
   );
 };
+
+
+type CertInfoProps = {
+  validUntil: string,
+  domain: string | null,
+}
+
+const CertInfo = ({validUntil, domain}: CertInfoProps) => ( 
+  <div className="cert-info">
+    <div>
+      {m.settings_certs_valid_until()}:
+      <span className="bold"> {displayDate(validUntil)}</span>
+    </div>
+    <div>
+      {m.settings_certs_domain()}:
+      <span className="bold"> {domain || '-'}</span>
+    </div>
+  </div>
+)
diff --git a/web/src/pages/settings/SettingsCertificatesPage/style.scss b/web/src/pages/settings/SettingsCertificatesPage/style.scss
new file mode 100644
index 0000000000..c61f4836fd
--- /dev/null
+++ b/web/src/pages/settings/SettingsCertificatesPage/style.scss
@@ -0,0 +1,10 @@
+.cert-info {
+  border-radius: 8px;
+  background: var(--bg-disabled);
+  font: var(--t-body-xs-400);
+  padding: var(--spacing-md);
+
+  .bold {
+    font: var(--t-body-xs-600);
+  }
+}
diff --git a/web/src/shared/api/types.ts b/web/src/shared/api/types.ts
index 3824614fb8..dfea8753db 100644
--- a/web/src/shared/api/types.ts
+++ b/web/src/shared/api/types.ts
@@ -71,8 +71,10 @@ export type EdgeCertSourceValue = (typeof EdgeCertSource)[keyof typeof EdgeCertS
 export interface GetCertsResponse {
   core_http_cert_source: CoreCertSourceValue;
   core_http_cert_expiry: string;
+  core_http_cert_domain: string | null;
   proxy_http_cert_source: EdgeCertSourceValue;
   proxy_http_cert_expiry: string;
+  proxy_http_cert_domain: string | null;
 }
 
 export interface UploadCARequest {

From 052107c97d3856927efd24c9066cf0384788080b Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Tue, 7 Apr 2026 09:10:54 +0200
Subject: [PATCH 23/29] badges

---
 .../SettingsCertificatesPage.tsx              | 94 +++++++++++++++----
 .../SettingsCertificatesPage/style.scss       | 29 ++++++
 2 files changed, 105 insertions(+), 18 deletions(-)

diff --git a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
index ebd85e5be9..bcd2381a4a 100644
--- a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
+++ b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
@@ -10,6 +10,7 @@ import { Page } from '../../../shared/components/Page/Page';
 import { SettingsCard } from '../../../shared/components/SettingsCard/SettingsCard';
 import { SettingsHeader } from '../../../shared/components/SettingsHeader/SettingsHeader';
 import { SettingsLayout } from '../../../shared/components/SettingsLayout/SettingsLayout';
+import { Badge } from '../../../shared/defguard-ui/components/Badge/Badge';
 import { Button } from '../../../shared/defguard-ui/components/Button/Button';
 import { Divider } from '../../../shared/defguard-ui/components/Divider/Divider';
 import { MarkedSection } from '../../../shared/defguard-ui/components/MarkedSection/MarkedSection';
@@ -17,8 +18,8 @@ import { MarkedSectionHeader } from '../../../shared/defguard-ui/components/Mark
 import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { ThemeSpacing } from '../../../shared/defguard-ui/types';
 import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
-import { downloadFile } from '../../../shared/utils/download';
 import { displayDate } from '../../../shared/utils/displayDate';
+import { downloadFile } from '../../../shared/utils/download';
 
 const breadcrumbs = [
   <Link
@@ -75,7 +76,6 @@ const Content = () => {
     downloadFile(blob, 'defguard-ca', 'pem');
   }, [caData?.ca_cert_pem]);
 
-  console.log(certsData);
   return (
     <>
       <MarkedSection icon="authorised-app">
@@ -97,11 +97,16 @@ const Content = () => {
         )}
         {certsData?.core_http_cert_source === 'SelfSigned' && (
           <>
-            <DescriptionBlock title={m.settings_certs_certs_internal_title()}>
-              <p>{m.settings_certs_certs_internal_description()}</p>
-            </DescriptionBlock>
+            <CertHeader
+              title={m.settings_certs_certs_internal_title()}
+              description={m.settings_certs_certs_internal_description()}
+              valid={certsData.core_http_cert_expiry}
+            />
             <SizedBox height={ThemeSpacing.Lg} />
-            <CertInfo validUntil={certsData.core_http_cert_expiry} domain={certsData.core_http_cert_domain}/>
+            <CertInfo
+              validUntil={certsData.core_http_cert_expiry}
+              domain={certsData.core_http_cert_domain}
+            />
             <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="outlined"
@@ -118,7 +123,10 @@ const Content = () => {
               <p>{m.settings_certs_certs_custom_description()}</p>
             </DescriptionBlock>
             <SizedBox height={ThemeSpacing.Lg} />
-            <CertInfo validUntil={certsData.core_http_cert_expiry} domain={certsData.core_http_cert_domain}/>
+            <CertInfo
+              validUntil={certsData.core_http_cert_expiry}
+              domain={certsData.core_http_cert_domain}
+            />
             <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="primary"
@@ -154,7 +162,10 @@ const Content = () => {
               <p>{m.settings_certs_certs_internal_description()}</p>
             </DescriptionBlock>
             <SizedBox height={ThemeSpacing.Lg} />
-            <CertInfo validUntil={certsData.proxy_http_cert_expiry} domain={certsData.proxy_http_cert_domain}/>
+            <CertInfo
+              validUntil={certsData.proxy_http_cert_expiry}
+              domain={certsData.proxy_http_cert_domain}
+            />
             <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="outlined"
@@ -171,7 +182,10 @@ const Content = () => {
               <p>{m.settings_certs_certs_custom_description()}</p>
             </DescriptionBlock>
             <SizedBox height={ThemeSpacing.Lg} />
-            <CertInfo validUntil={certsData.proxy_http_cert_expiry} domain={certsData.proxy_http_cert_domain}/>
+            <CertInfo
+              validUntil={certsData.proxy_http_cert_expiry}
+              domain={certsData.proxy_http_cert_domain}
+            />
             <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="primary"
@@ -188,7 +202,10 @@ const Content = () => {
               <p>{m.settings_certs_certs_letsencrypt_description()}</p>
             </DescriptionBlock>
             <SizedBox height={ThemeSpacing.Lg} />
-            <CertInfo validUntil={certsData.proxy_http_cert_expiry} domain={certsData.proxy_http_cert_domain}/>
+            <CertInfo
+              validUntil={certsData.proxy_http_cert_expiry}
+              domain={certsData.proxy_http_cert_domain}
+            />
             <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="primary"
@@ -204,21 +221,62 @@ const Content = () => {
   );
 };
 
-
 type CertInfoProps = {
-  validUntil: string,
-  domain: string | null,
-}
+  validUntil: string;
+  domain: string | null;
+};
 
-const CertInfo = ({validUntil, domain}: CertInfoProps) => ( 
+const CertInfo = ({ validUntil, domain }: CertInfoProps) => (
   <div className="cert-info">
     <div>
       {m.settings_certs_valid_until()}:
       <span className="bold"> {displayDate(validUntil)}</span>
     </div>
     <div>
-      {m.settings_certs_domain()}:
-      <span className="bold"> {domain || '-'}</span>
+      {m.settings_certs_domain()}:<span className="bold"> {domain || '-'}</span>
     </div>
   </div>
-)
+);
+
+type ValidDescriptionBlockProps = {
+  title: string;
+  description: string;
+  valid: string;
+};
+
+const getValidForDays = (valid: string) => {
+  const validDate = new Date(valid);
+  if (Number.isNaN(validDate.getTime())) return null;
+
+  const millisecondsPerDay = 1000 * 60 * 60 * 24;
+  return Math.max(0, Math.ceil((validDate.getTime() - Date.now()) / millisecondsPerDay));
+};
+
+export const CertHeader = ({ title, description, valid }: ValidDescriptionBlockProps) => {
+  const validFor = getValidForDays(valid);
+  let badgeText;
+  let badgeVariant: "success" | "warning" | "critical";
+  if (validFor === null || validFor > 30) {
+    badgeText = "Valid";
+    badgeVariant = "success";
+  } else if (validFor > 0) {
+    badgeText = "Expires soon";
+    badgeVariant = "warning";
+  } else {
+    badgeText = "Expired";
+    badgeVariant = "critical";
+  }
+
+  return (
+    <div className="description-block">
+      <div className="header">
+        <div className="title">{title}</div>
+        <Badge text={badgeText} variant={badgeVariant}/>
+      </div>
+      <SizedBox height={ThemeSpacing.Xs} />
+      <div>
+        <p>{description}</p>
+      </div>
+    </div>
+  );
+};
diff --git a/web/src/pages/settings/SettingsCertificatesPage/style.scss b/web/src/pages/settings/SettingsCertificatesPage/style.scss
index c61f4836fd..caae0c9c6b 100644
--- a/web/src/pages/settings/SettingsCertificatesPage/style.scss
+++ b/web/src/pages/settings/SettingsCertificatesPage/style.scss
@@ -8,3 +8,32 @@
     font: var(--t-body-xs-600);
   }
 }
+
+.description-block {
+  &>.header {
+    display: flex;
+    justify-content: space-between;
+
+    &>.title {
+      font: var(--t-body-sm-500);
+    }
+
+    &>div {
+      p {
+        font: var(--t-body-sm-400);
+        color: var(--fg-muted);
+      }
+
+      a {
+        font: var(--t-body-sm-400);
+        color: var(--fg-action);
+        text-decoration: none;
+
+        &:hover {
+          text-decoration: underline;
+          text-decoration-color: var(--fg-action);
+        }
+      }
+    }
+  }
+}

From eaa4fc3fdc0a883f8b658905da37c5b5b45b445a Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Tue, 7 Apr 2026 09:18:14 +0200
Subject: [PATCH 24/29] show badges for all cert types

---
 .../SettingsCertificatesPage.tsx              | 32 ++++++++++++-------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
index bcd2381a4a..3c6c81b639 100644
--- a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
+++ b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
@@ -119,9 +119,11 @@ const Content = () => {
         )}
         {certsData?.core_http_cert_source === 'Custom' && (
           <>
-            <DescriptionBlock title={m.settings_certs_certs_custom_title()}>
-              <p>{m.settings_certs_certs_custom_description()}</p>
-            </DescriptionBlock>
+            <CertHeader
+              title={m.settings_certs_certs_custom_title()}
+              description={m.settings_certs_certs_custom_description()}
+              valid={certsData.core_http_cert_expiry}
+            />
             <SizedBox height={ThemeSpacing.Lg} />
             <CertInfo
               validUntil={certsData.core_http_cert_expiry}
@@ -158,9 +160,11 @@ const Content = () => {
         )}
         {certsData?.proxy_http_cert_source === 'SelfSigned' && (
           <>
-            <DescriptionBlock title={m.settings_certs_certs_internal_title()}>
-              <p>{m.settings_certs_certs_internal_description()}</p>
-            </DescriptionBlock>
+            <CertHeader
+              title={m.settings_certs_certs_internal_title()}
+              description={m.settings_certs_certs_internal_description()}
+              valid={certsData.proxy_http_cert_expiry}
+            />
             <SizedBox height={ThemeSpacing.Lg} />
             <CertInfo
               validUntil={certsData.proxy_http_cert_expiry}
@@ -178,9 +182,11 @@ const Content = () => {
         )}
         {certsData?.proxy_http_cert_source === 'Custom' && (
           <>
-            <DescriptionBlock title={m.settings_certs_certs_custom_title()}>
-              <p>{m.settings_certs_certs_custom_description()}</p>
-            </DescriptionBlock>
+            <CertHeader
+              title={m.settings_certs_certs_custom_title()}
+              description={m.settings_certs_certs_custom_description()}
+              valid={certsData.proxy_http_cert_expiry}
+            />
             <SizedBox height={ThemeSpacing.Lg} />
             <CertInfo
               validUntil={certsData.proxy_http_cert_expiry}
@@ -198,9 +204,11 @@ const Content = () => {
         )}
         {certsData?.proxy_http_cert_source === 'LetsEncrypt' && (
           <>
-            <DescriptionBlock title={m.settings_certs_certs_letsencrypt_title()}>
-              <p>{m.settings_certs_certs_letsencrypt_description()}</p>
-            </DescriptionBlock>
+            <CertHeader
+              title={m.settings_certs_certs_letsencrypt_title()}
+              description={m.settings_certs_certs_letsencrypt_description()}
+              valid={certsData.proxy_http_cert_expiry}
+            />
             <SizedBox height={ThemeSpacing.Lg} />
             <CertInfo
               validUntil={certsData.proxy_http_cert_expiry}

From 2684fb4fbf2c281b1ae7346e8d4b46bc79e8c196 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Tue, 7 Apr 2026 09:30:43 +0200
Subject: [PATCH 25/29] change certs button for self-signed sections

---
 .../SettingsCertificatesPage.tsx              | 52 +++++++++++++------
 .../SettingsCertificatesPage/style.scss       |  4 ++
 2 files changed, 40 insertions(+), 16 deletions(-)

diff --git a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
index 3c6c81b639..c9dcb74ede 100644
--- a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
+++ b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
@@ -108,13 +108,23 @@ const Content = () => {
               domain={certsData.core_http_cert_domain}
             />
             <SizedBox height={ThemeSpacing.Lg} />
-            <Button
-              variant="outlined"
-              text={m.settings_certs_ca_download()}
-              onClick={downloadCaCert}
-              loading={isFetching || isFetchingCa}
-              disabled={!isPresent(caData?.ca_cert_pem) || isFetching || isFetchingCa}
-            />
+            <div className="cert-footer">
+              <Button
+                variant="outlined"
+                text={m.settings_certs_ca_download()}
+                onClick={downloadCaCert}
+                loading={isFetching || isFetchingCa}
+                disabled={!isPresent(caData?.ca_cert_pem) || isFetching || isFetchingCa}
+              />
+              <SizedBox width={ThemeSpacing.Md} height={ThemeSpacing.Xs} />
+              <Button
+                variant="primary"
+                text={m.settings_certs_certs_custom_change()}
+                onClick={() => void navigate({ to: '/settings-core-certificate' })}
+                loading={false}
+                disabled={false}
+              />
+            </div>
           </>
         )}
         {certsData?.core_http_cert_source === 'Custom' && (
@@ -171,13 +181,23 @@ const Content = () => {
               domain={certsData.proxy_http_cert_domain}
             />
             <SizedBox height={ThemeSpacing.Lg} />
-            <Button
-              variant="outlined"
-              text={m.settings_certs_ca_download()}
-              onClick={downloadCaCert}
-              loading={isFetching || isFetchingCa}
-              disabled={!isPresent(caData?.ca_cert_pem) || isFetching || isFetchingCa}
-            />
+            <div className="cert-footer">
+              <Button
+                variant="outlined"
+                text={m.settings_certs_ca_download()}
+                onClick={downloadCaCert}
+                loading={isFetching || isFetchingCa}
+                disabled={!isPresent(caData?.ca_cert_pem) || isFetching || isFetchingCa}
+              />
+              <SizedBox width={ThemeSpacing.Md} height={ThemeSpacing.Xs} />
+              <Button
+                variant="primary"
+                text={m.settings_certs_certs_custom_change()}
+                onClick={() => void navigate({ to: '/settings-edge-certificate' })}
+                loading={false}
+                disabled={false}
+              />
+            </div>
           </>
         )}
         {certsData?.proxy_http_cert_source === 'Custom' && (
@@ -224,7 +244,7 @@ const Content = () => {
             />
           </>
         )}
-      </MarkedSection>
+      </MarkedSection >
     </>
   );
 };
@@ -279,7 +299,7 @@ export const CertHeader = ({ title, description, valid }: ValidDescriptionBlockP
     <div className="description-block">
       <div className="header">
         <div className="title">{title}</div>
-        <Badge text={badgeText} variant={badgeVariant}/>
+        <Badge text={badgeText} variant={badgeVariant} />
       </div>
       <SizedBox height={ThemeSpacing.Xs} />
       <div>
diff --git a/web/src/pages/settings/SettingsCertificatesPage/style.scss b/web/src/pages/settings/SettingsCertificatesPage/style.scss
index caae0c9c6b..85f290107a 100644
--- a/web/src/pages/settings/SettingsCertificatesPage/style.scss
+++ b/web/src/pages/settings/SettingsCertificatesPage/style.scss
@@ -37,3 +37,7 @@
     }
   }
 }
+
+.cert-footer {
+  display: flex;
+}

From f875482253dcc7c89596a2c949280a6ccb874cc0 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Tue, 7 Apr 2026 09:39:36 +0200
Subject: [PATCH 26/29] fix "Change certificate" buttons

---
 web/messages/en/settings.json                      |  3 +--
 .../SettingsCertificatesPage.tsx                   | 14 +++++++-------
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/web/messages/en/settings.json b/web/messages/en/settings.json
index 99d53d5f50..64e12c7ffb 100644
--- a/web/messages/en/settings.json
+++ b/web/messages/en/settings.json
@@ -55,12 +55,11 @@
   "settings_certs_core_wizard_summary_ok": "OK",
   "settings_certs_certs_none_title": "No SSL certificate",
   "settings_certs_certs_none_description": "You have opted to deploy a custom Reverse Proxy and manage your own SSL certificates. ",
-  "settings_certs_certs_none_add_certificate": "Add certificate",
   "settings_certs_certs_internal_title": "Defguard Internal CA",
   "settings_certs_certs_internal_description": "Manage certificates automatically generated by Defguard for secure communication.",
   "settings_certs_certs_custom_title": "Your own certificate",
   "settings_certs_certs_custom_description": "You are using your own, custom SSL certificate.",
-  "settings_certs_certs_custom_change": "Change/upload certificate",
+  "settings_certs_certs_change": "Change certificate",
   "settings_certs_certs_letsencrypt_title": "\"Let's Encrypt\"® certificate",
   "settings_certs_certs_letsencrypt_description": "You are using a \"Let's Encrypt\"® issued certificate.",
   "settings_certs_certs_edge_title": "Edge certificate",
diff --git a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
index c9dcb74ede..401482df1b 100644
--- a/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
+++ b/web/src/pages/settings/SettingsCertificatesPage/SettingsCertificatesPage.tsx
@@ -88,7 +88,7 @@ const Content = () => {
             <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="primary"
-              text={m.settings_certs_certs_none_add_certificate()}
+              text={m.settings_certs_certs_change()}
               onClick={() => void navigate({ to: '/settings-core-certificate' })}
               loading={false}
               disabled={false}
@@ -119,7 +119,7 @@ const Content = () => {
               <SizedBox width={ThemeSpacing.Md} height={ThemeSpacing.Xs} />
               <Button
                 variant="primary"
-                text={m.settings_certs_certs_custom_change()}
+                text={m.settings_certs_certs_change()}
                 onClick={() => void navigate({ to: '/settings-core-certificate' })}
                 loading={false}
                 disabled={false}
@@ -142,7 +142,7 @@ const Content = () => {
             <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="primary"
-              text={m.settings_certs_certs_custom_change()}
+              text={m.settings_certs_certs_change()}
               onClick={() => void navigate({ to: '/settings-core-certificate' })}
               loading={false}
               disabled={false}
@@ -161,7 +161,7 @@ const Content = () => {
             <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="primary"
-              text={m.settings_certs_certs_none_add_certificate()}
+              text={m.settings_certs_certs_change()}
               onClick={() => void navigate({ to: '/settings-edge-certificate' })}
               loading={false}
               disabled={false}
@@ -192,7 +192,7 @@ const Content = () => {
               <SizedBox width={ThemeSpacing.Md} height={ThemeSpacing.Xs} />
               <Button
                 variant="primary"
-                text={m.settings_certs_certs_custom_change()}
+                text={m.settings_certs_certs_change()}
                 onClick={() => void navigate({ to: '/settings-edge-certificate' })}
                 loading={false}
                 disabled={false}
@@ -215,7 +215,7 @@ const Content = () => {
             <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="primary"
-              text={m.settings_certs_certs_custom_change()}
+              text={m.settings_certs_certs_change()}
               onClick={() => void navigate({ to: '/settings-edge-certificate' })}
               loading={false}
               disabled={false}
@@ -237,7 +237,7 @@ const Content = () => {
             <SizedBox height={ThemeSpacing.Lg} />
             <Button
               variant="primary"
-              text={m.settings_certs_certs_custom_change()}
+              text={m.settings_certs_certs_change()}
               onClick={() => void navigate({ to: '/settings-edge-certificate' })}
               loading={false}
               disabled={false}

From 88360bfa81cb39c0451b8f73e8a1ef6070972125 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Tue, 7 Apr 2026 11:58:09 +0200
Subject: [PATCH 27/29] all cert-setting paths restart proxy web server

---
 .../defguard_core/src/handlers/core_certs.rs  | 25 +++++++++++++++++++
 .../tests/integration/api/proxy_certs.rs      | 16 +++++++++++-
 2 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/crates/defguard_core/src/handlers/core_certs.rs b/crates/defguard_core/src/handlers/core_certs.rs
index e98460f458..28a9bdec36 100644
--- a/crates/defguard_core/src/handlers/core_certs.rs
+++ b/crates/defguard_core/src/handlers/core_certs.rs
@@ -302,6 +302,19 @@ fn cert_common_name(cert_pem: Option<&str>) -> Option<String> {
     Some(cert_info.subject_common_name)
 }
 
+async fn broadcast_proxy_https_certs(appstate: &AppState, cert_pem: String, key_pem: String) {
+    if let Err(err) = appstate
+        .proxy_control_tx
+        .send(defguard_common::types::proxy::ProxyControlMessage::BroadcastHttpsCerts {
+            cert_pem,
+            key_pem,
+        })
+        .await
+    {
+        error!("Failed to broadcast HttpsCerts to proxies: {err:?}");
+    }
+}
+
 /// Upload a custom PEM certificate + private key for core HTTPS.
 #[derive(Serialize, Deserialize, ToSchema)]
 pub struct CoreCustomCertUpload {
@@ -496,13 +509,25 @@ pub(crate) async fn set_internal_url_settings(
     security(("cookie" = []), ("api_token" = []))
 )]
 pub(crate) async fn set_external_url_settings(
+    State(appstate): State<AppState>,
     _role: AdminRole,
     Extension(pool): Extension<PgPool>,
     Json(config): Json<ExternalUrlSettingsConfig>,
 ) -> ApiResult {
     info!("Applying proxy external URL certificate settings");
     let settings = defguard_common::db::models::Settings::get_current_settings();
+    let ssl_type = config.ssl_type.clone();
     let cert_info = apply_external_url_settings(&pool, &settings.public_proxy_url, config).await?;
+
+    if matches!(ssl_type, ExternalSslType::DefguardCa | ExternalSslType::OwnCert) {
+        let certs = Certificates::get_or_default(&pool)
+            .await
+            .map_err(WebError::from)?;
+        if let Some((cert_pem, key_pem)) = certs.proxy_http_cert_pair() {
+            broadcast_proxy_https_certs(&appstate, cert_pem.to_owned(), key_pem.to_owned()).await;
+        }
+    }
+
     info!("Proxy external URL certificate settings applied");
 
     Ok(ApiResponse::new(
diff --git a/crates/defguard_core/tests/integration/api/proxy_certs.rs b/crates/defguard_core/tests/integration/api/proxy_certs.rs
index 56a21317ac..b962f0ad98 100644
--- a/crates/defguard_core/tests/integration/api/proxy_certs.rs
+++ b/crates/defguard_core/tests/integration/api/proxy_certs.rs
@@ -497,7 +497,7 @@ async fn test_proxy_cert_pair_none_by_default(_: PgPoolOptions, opts: PgConnectO
 #[sqlx::test]
 async fn test_external_url_settings_endpoint(_: PgPoolOptions, opts: PgConnectOptions) {
     let pool = setup_pool(opts).await;
-    let (mut client, _capture, pool) = make_test_client_with_proxy_rx(pool).await;
+    let (mut client, mut capture, pool) = make_test_client_with_proxy_rx(pool).await;
     login_admin(&mut client).await;
 
     let mut settings = Settings::get_current_settings();
@@ -517,6 +517,7 @@ async fn test_external_url_settings_endpoint(_: PgPoolOptions, opts: PgConnectOp
     assert!(saved.proxy_http_cert_key_pem.is_none());
     assert!(saved.proxy_http_cert_expiry.is_none());
     assert!(saved.acme_domain.is_none());
+    assert!(capture.drain_broadcast_certs().await.is_empty());
 
     let response = client
         .post("/api/v1/proxy/cert/external_url_settings")
@@ -532,6 +533,7 @@ async fn test_external_url_settings_endpoint(_: PgPoolOptions, opts: PgConnectOp
     assert_eq!(saved.proxy_http_cert_source, ProxyCertSource::LetsEncrypt);
     assert_eq!(saved.acme_domain.as_deref(), Some("edge.example.com"));
     assert!(saved.proxy_http_cert_pem.is_none());
+    assert!(capture.drain_broadcast_certs().await.is_empty());
 
     seed_ca(&pool).await;
 
@@ -558,7 +560,14 @@ async fn test_external_url_settings_endpoint(_: PgPoolOptions, opts: PgConnectOp
     );
     assert!(saved.acme_domain.is_none());
 
+    let broadcasts = capture.drain_broadcast_certs().await;
+    assert_eq!(broadcasts.len(), 1, "Expected exactly one broadcast");
+    assert!(broadcasts[0].0.contains("BEGIN CERTIFICATE"));
+    assert!(broadcasts[0].1.contains("BEGIN PRIVATE KEY"));
+
     let (cert_pem, key_pem) = generate_test_cert_pem("uploaded-edge.example.com");
+    let expected_cert_pem = cert_pem.clone();
+    let expected_key_pem = key_pem.clone();
     let response = client
         .post("/api/v1/proxy/cert/external_url_settings")
         .json(&json!({
@@ -578,6 +587,11 @@ async fn test_external_url_settings_endpoint(_: PgPoolOptions, opts: PgConnectOp
     assert!(saved.proxy_http_cert_expiry.is_some());
     assert!(saved.acme_domain.is_none());
 
+    let broadcasts = capture.drain_broadcast_certs().await;
+    assert_eq!(broadcasts.len(), 1, "Expected exactly one broadcast");
+    assert_eq!(broadcasts[0].0, expected_cert_pem);
+    assert_eq!(broadcasts[0].1, expected_key_pem);
+
     let response = client
         .post("/api/v1/proxy/cert/external_url_settings")
         .json(&json!({

From da6f52a3b85abe8520cd8f6f29d8fdbf05b66a5b Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Tue, 7 Apr 2026 12:40:45 +0200
Subject: [PATCH 28/29] restart web server after cert changes

---
 crates/defguard/src/main.rs                   |  2 +
 crates/defguard_certs/src/lib.rs              |  9 +-
 crates/defguard_common/src/types/proxy.rs     |  1 +
 crates/defguard_core/src/appstate.rs          |  3 +
 .../defguard_core/src/handlers/core_certs.rs  | 49 ++++++++--
 crates/defguard_core/src/lib.rs               | 91 ++++++++++++++-----
 .../tests/integration/api/common/mod.rs       |  2 +
 .../tests/integration/api/proxy_certs.rs      | 24 ++++-
 crates/defguard_proxy_manager/src/lib.rs      | 15 +++
 .../src/handlers/initial_wizard.rs            | 12 +--
 crates/defguard_setup/src/migration.rs        |  2 +
 proto                                         |  2 +-
 12 files changed, 164 insertions(+), 48 deletions(-)

diff --git a/crates/defguard/src/main.rs b/crates/defguard/src/main.rs
index 7c4d82424a..dd1c82300b 100644
--- a/crates/defguard/src/main.rs
+++ b/crates/defguard/src/main.rs
@@ -233,6 +233,7 @@ async fn main() -> Result<(), anyhow::Error> {
     update_counts(&pool).await?;
 
     let (proxy_control_tx, proxy_control_rx) = channel::<ProxyControlMessage>(100);
+    let (web_reload_tx, _web_reload_rx) = tokio::sync::broadcast::channel::<()>(8);
     let proxy_secret_key = settings.secret_key_required()?;
     let proxy_manager = ProxyManager::new(
         pool.clone(),
@@ -270,6 +271,7 @@ async fn main() -> Result<(), anyhow::Error> {
             webhook_tx,
             webhook_rx,
             gateway_tx.clone(),
+            web_reload_tx,
             pool.clone(),
             failed_logins,
             api_event_tx,
diff --git a/crates/defguard_certs/src/lib.rs b/crates/defguard_certs/src/lib.rs
index 970e786dc2..15792afc49 100644
--- a/crates/defguard_certs/src/lib.rs
+++ b/crates/defguard_certs/src/lib.rs
@@ -1,13 +1,12 @@
 use std::str::FromStr;
 
-use base64::{prelude::BASE64_STANDARD, Engine};
+use base64::{Engine, prelude::BASE64_STANDARD};
 use chrono::NaiveDateTime;
 use rcgen::{
-    string::Ia5String, BasicConstraints, Certificate, CertificateParams,
-    CertificateSigningRequestParams, ExtendedKeyUsagePurpose, IsCa, Issuer, KeyPair,
-    KeyUsagePurpose, SigningKey,
+    BasicConstraints, Certificate, CertificateParams, CertificateSigningRequestParams,
+    ExtendedKeyUsagePurpose, IsCa, Issuer, KeyPair, KeyUsagePurpose, SigningKey, string::Ia5String,
 };
-use rustls_pki_types::{pem::PemObject, CertificateDer, CertificateSigningRequestDer};
+use rustls_pki_types::{CertificateDer, CertificateSigningRequestDer, pem::PemObject};
 use thiserror::Error;
 use time::{Duration, OffsetDateTime};
 use x509_parser::{
diff --git a/crates/defguard_common/src/types/proxy.rs b/crates/defguard_common/src/types/proxy.rs
index 9867894f9d..503f5996f1 100644
--- a/crates/defguard_common/src/types/proxy.rs
+++ b/crates/defguard_common/src/types/proxy.rs
@@ -14,6 +14,7 @@ pub enum ProxyControlMessage {
         cert_pem: String,
         key_pem: String,
     },
+    ClearHttpsCerts,
 }
 
 #[derive(ToSchema, Serialize)]
diff --git a/crates/defguard_core/src/appstate.rs b/crates/defguard_core/src/appstate.rs
index 644a93914d..7243cf6a4e 100644
--- a/crates/defguard_core/src/appstate.rs
+++ b/crates/defguard_core/src/appstate.rs
@@ -30,6 +30,7 @@ pub struct AppState {
     pub pool: PgPool,
     tx: UnboundedSender<AppEvent>,
     pub wireguard_tx: Sender<GatewayEvent>,
+    pub web_reload_tx: tokio::sync::broadcast::Sender<()>,
     pub failed_logins: Arc<Mutex<FailedLoginMap>>,
     key: Key,
     pub event_tx: UnboundedSender<ApiEvent>,
@@ -116,6 +117,7 @@ impl AppState {
         tx: UnboundedSender<AppEvent>,
         rx: UnboundedReceiver<AppEvent>,
         wireguard_tx: Sender<GatewayEvent>,
+        web_reload_tx: tokio::sync::broadcast::Sender<()>,
         key: Key,
         failed_logins: Arc<Mutex<FailedLoginMap>>,
         event_tx: UnboundedSender<ApiEvent>,
@@ -128,6 +130,7 @@ impl AppState {
             pool,
             tx,
             wireguard_tx,
+            web_reload_tx,
             failed_logins,
             key,
             event_tx,
diff --git a/crates/defguard_core/src/handlers/core_certs.rs b/crates/defguard_core/src/handlers/core_certs.rs
index 28a9bdec36..c87c99bf5d 100644
--- a/crates/defguard_core/src/handlers/core_certs.rs
+++ b/crates/defguard_core/src/handlers/core_certs.rs
@@ -1,7 +1,7 @@
 use axum::{Extension, Json, extract::State, http::StatusCode};
 use defguard_certs::{
-    CertificateAuthority, CertificateInfo, Csr, DnType, PemLabel, der_to_pem,
-    generate_key_pair, parse_pem_certificate,
+    CertificateAuthority, CertificateInfo, Csr, DnType, PemLabel, der_to_pem, generate_key_pair,
+    parse_pem_certificate,
 };
 use defguard_common::db::models::{
     Certificates, CoreCertSource, ProxyCertSource, settings::update_current_settings,
@@ -186,8 +186,10 @@ pub async fn apply_external_url_settings(
         .await
         .map_err(WebError::from)?;
 
-    let hostname = if matches!(config.ssl_type, ExternalSslType::LetsEncrypt | ExternalSslType::DefguardCa)
-    {
+    let hostname = if matches!(
+        config.ssl_type,
+        ExternalSslType::LetsEncrypt | ExternalSslType::DefguardCa
+    ) {
         let url = public_proxy_url.trim();
         if url.is_empty() {
             return Err(WebError::BadRequest(
@@ -305,16 +307,34 @@ fn cert_common_name(cert_pem: Option<&str>) -> Option<String> {
 async fn broadcast_proxy_https_certs(appstate: &AppState, cert_pem: String, key_pem: String) {
     if let Err(err) = appstate
         .proxy_control_tx
-        .send(defguard_common::types::proxy::ProxyControlMessage::BroadcastHttpsCerts {
-            cert_pem,
-            key_pem,
-        })
+        .send(
+            defguard_common::types::proxy::ProxyControlMessage::BroadcastHttpsCerts {
+                cert_pem,
+                key_pem,
+            },
+        )
         .await
     {
         error!("Failed to broadcast HttpsCerts to proxies: {err:?}");
     }
 }
 
+async fn clear_proxy_https_certs(appstate: &AppState) {
+    if let Err(err) = appstate
+        .proxy_control_tx
+        .send(defguard_common::types::proxy::ProxyControlMessage::ClearHttpsCerts)
+        .await
+    {
+        error!("Failed to broadcast ClearHttpsCerts to proxies: {err:?}");
+    }
+}
+
+fn reload_core_web_server(appstate: &AppState) {
+    if let Err(err) = appstate.web_reload_tx.send(()) {
+        error!("Failed to trigger core web server reload: {err:?}");
+    }
+}
+
 /// Upload a custom PEM certificate + private key for core HTTPS.
 #[derive(Serialize, Deserialize, ToSchema)]
 pub struct CoreCustomCertUpload {
@@ -361,6 +381,8 @@ pub(crate) async fn core_cert_upload(
         WebError::Http(StatusCode::INTERNAL_SERVER_ERROR)
     })?;
 
+    reload_core_web_server(&appstate);
+
     info!(
         "User {} uploaded custom core certificate",
         session.user.username
@@ -459,6 +481,8 @@ pub(crate) async fn core_cert_self_signed(
         WebError::Http(StatusCode::INTERNAL_SERVER_ERROR)
     })?;
 
+    reload_core_web_server(&appstate);
+
     info!(
         "User {} provisioned self-signed core certificate (SAN: {:?})",
         session.user.username, data.san
@@ -480,6 +504,7 @@ pub(crate) async fn core_cert_self_signed(
     security(("cookie" = []), ("api_token" = []))
 )]
 pub(crate) async fn set_internal_url_settings(
+    State(appstate): State<AppState>,
     _role: AdminRole,
     Extension(pool): Extension<PgPool>,
     Json(config): Json<InternalUrlSettingsConfig>,
@@ -487,6 +512,7 @@ pub(crate) async fn set_internal_url_settings(
     info!("Applying core internal URL certificate settings");
     let settings = defguard_common::db::models::Settings::get_current_settings();
     let cert_info = apply_internal_url_settings(&pool, &settings.defguard_url, config).await?;
+    reload_core_web_server(&appstate);
     info!("Core internal URL certificate settings applied");
 
     Ok(ApiResponse::new(
@@ -519,13 +545,18 @@ pub(crate) async fn set_external_url_settings(
     let ssl_type = config.ssl_type.clone();
     let cert_info = apply_external_url_settings(&pool, &settings.public_proxy_url, config).await?;
 
-    if matches!(ssl_type, ExternalSslType::DefguardCa | ExternalSslType::OwnCert) {
+    if matches!(
+        ssl_type,
+        ExternalSslType::DefguardCa | ExternalSslType::OwnCert
+    ) {
         let certs = Certificates::get_or_default(&pool)
             .await
             .map_err(WebError::from)?;
         if let Some((cert_pem, key_pem)) = certs.proxy_http_cert_pair() {
             broadcast_proxy_https_certs(&appstate, cert_pem.to_owned(), key_pem.to_owned()).await;
         }
+    } else if ssl_type == ExternalSslType::None {
+        clear_proxy_https_certs(&appstate).await;
     }
 
     info!("Proxy external URL certificate settings applied");
diff --git a/crates/defguard_core/src/lib.rs b/crates/defguard_core/src/lib.rs
index 5525f065f3..03245a9290 100644
--- a/crates/defguard_core/src/lib.rs
+++ b/crates/defguard_core/src/lib.rs
@@ -2,6 +2,7 @@
 use std::{
     net::{IpAddr, Ipv4Addr, SocketAddr},
     sync::{Arc, LazyLock, Mutex, RwLock},
+    time::Duration,
 };
 
 use anyhow::anyhow;
@@ -118,8 +119,8 @@ use crate::{
         },
         component_setup::setup_gateway_tls_stream,
         core_certs::{
-            core_cert_self_signed, core_cert_upload, get_ca, get_certs,
-            set_external_url_settings, set_internal_url_settings,
+            core_cert_self_signed, core_cert_upload, get_ca, get_certs, set_external_url_settings,
+            set_internal_url_settings,
         },
         forward_auth::forward_auth,
         gateway::{delete_gateway, gateway_details, gateway_list, update_gateway},
@@ -228,6 +229,7 @@ pub fn build_webapp(
     webhook_tx: UnboundedSender<AppEvent>,
     webhook_rx: UnboundedReceiver<AppEvent>,
     wireguard_tx: Sender<GatewayEvent>,
+    web_reload_tx: tokio::sync::broadcast::Sender<()>,
     worker_state: Arc<Mutex<WorkerState>>,
     pool: PgPool,
     key: Key,
@@ -392,7 +394,10 @@ pub fn build_webapp(
             // Core HTTPS cert routes
             .route("/core/cert/upload", post(core_cert_upload))
             .route("/core/cert/self-signed", post(core_cert_self_signed))
-            .route("/core/cert/internal_url_settings", post(set_internal_url_settings))
+            .route(
+                "/core/cert/internal_url_settings",
+                post(set_internal_url_settings),
+            )
             .route("/core/cert/ca", get(get_ca))
             .route("/core/cert/certs", get(get_certs))
             // Gateway routes
@@ -629,6 +634,7 @@ pub fn build_webapp(
             webhook_tx,
             webhook_rx,
             wireguard_tx,
+            web_reload_tx,
             key,
             failed_logins,
             event_tx,
@@ -658,6 +664,7 @@ pub async fn run_web_server(
     webhook_tx: UnboundedSender<AppEvent>,
     webhook_rx: UnboundedReceiver<AppEvent>,
     wireguard_tx: Sender<GatewayEvent>,
+    web_reload_tx: tokio::sync::broadcast::Sender<()>,
     pool: PgPool,
     failed_logins: Arc<Mutex<FailedLoginMap>>,
     event_tx: UnboundedSender<ApiEvent>,
@@ -667,21 +674,13 @@ pub async fn run_web_server(
     let settings = Settings::get_current_settings();
     let key = Key::from(settings.secret_key_required()?.as_bytes());
 
-    // Read certs before build_webapp consumes the pool.
-    let tls_cert_pair = Certificates::get_or_default(&pool)
-        .await
-        .map(|c| {
-            c.core_http_cert_pair()
-                .map(|(cert, key)| (cert.to_owned(), key.to_owned()))
-        })
-        .unwrap_or(None);
-
     let webapp = build_webapp(
         webhook_tx,
         webhook_rx,
         wireguard_tx,
+        web_reload_tx.clone(),
         worker_state,
-        pool,
+        pool.clone(),
         key,
         failed_logins,
         event_tx,
@@ -698,19 +697,61 @@ pub async fn run_web_server(
         server_config.http_port,
     );
 
-    if let Some((cert_pem, key_pem)) = tls_cert_pair {
-        let tls_config = RustlsConfig::from_pem(cert_pem.into_bytes(), key_pem.into_bytes())
-            .await
-            .map_err(|err| anyhow!("Failed to load TLS config: {err}"))?;
-        axum_server::bind_rustls(addr, tls_config)
-            .serve(webapp.into_make_service_with_connect_info::<SocketAddr>())
-            .await
-            .map_err(|err| anyhow!("Web server error: {err}"))
-    } else {
-        axum_server::bind(addr)
-            .serve(webapp.into_make_service_with_connect_info::<SocketAddr>())
+    let mut web_reload_rx = web_reload_tx.subscribe();
+
+    loop {
+        let handle = axum_server::Handle::new();
+        let handle_clone = handle.clone();
+        let app = webapp.clone().into_make_service_with_connect_info::<SocketAddr>();
+        let current_tls_cert_pair = Certificates::get_or_default(&pool)
             .await
-            .map_err(|err| anyhow!("Web server error: {err}"))
+            .map(|c| c.core_http_cert_pair().map(|(cert, key)| (cert.to_owned(), key.to_owned())))
+            .unwrap_or(None);
+
+        let mut server_task = tokio::spawn(async move {
+            if let Some((cert_pem, key_pem)) = current_tls_cert_pair {
+                let tls_config = RustlsConfig::from_pem(cert_pem.into_bytes(), key_pem.into_bytes())
+                    .await
+                    .map_err(|err| anyhow!("Failed to load TLS config: {err}"))?;
+                axum_server::bind_rustls(addr, tls_config)
+                    .handle(handle_clone.clone())
+                    .serve(app)
+                    .await
+                    .map_err(|err| anyhow!("Web server error: {err}"))
+            } else {
+                axum_server::bind(addr)
+                    .handle(handle_clone)
+                    .serve(app)
+                    .await
+                    .map_err(|err| anyhow!("Web server error: {err}"))
+            }
+        });
+
+        tokio::select! {
+            result = &mut server_task => {
+                match result {
+                    Ok(result) => return result,
+                    Err(err) => return Err(anyhow!("Web server task panicked: {err}")),
+                }
+            }
+            result = web_reload_rx.recv() => {
+                match result {
+                    Ok(()) => {
+                        info!("Received core web server reload request, restarting listener");
+                        handle.graceful_shutdown(Some(Duration::from_secs(30)));
+                        let _ = server_task.await;
+                    }
+                    Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => {
+                        info!("Missed core web server reload signal, restarting listener");
+                        handle.graceful_shutdown(Some(Duration::from_secs(30)));
+                        let _ = server_task.await;
+                    }
+                    Err(tokio::sync::broadcast::error::RecvError::Closed) => {
+                        return Err(anyhow!("Core web reload channel closed unexpectedly"));
+                    }
+                }
+            }
+        }
     }
 }
 
diff --git a/crates/defguard_core/tests/integration/api/common/mod.rs b/crates/defguard_core/tests/integration/api/common/mod.rs
index a1886a0f15..e8adf11d17 100644
--- a/crates/defguard_core/tests/integration/api/common/mod.rs
+++ b/crates/defguard_core/tests/integration/api/common/mod.rs
@@ -131,11 +131,13 @@ pub(crate) async fn make_base_client(
             .unwrap()
             .as_bytes(),
     );
+    let (web_reload_tx, _web_reload_rx) = broadcast::channel::<()>(8);
 
     let webapp = build_webapp(
         tx,
         rx,
         wg_tx,
+        web_reload_tx,
         worker_state,
         pool,
         key,
diff --git a/crates/defguard_core/tests/integration/api/proxy_certs.rs b/crates/defguard_core/tests/integration/api/proxy_certs.rs
index b962f0ad98..50928fb5b3 100644
--- a/crates/defguard_core/tests/integration/api/proxy_certs.rs
+++ b/crates/defguard_core/tests/integration/api/proxy_certs.rs
@@ -73,6 +73,21 @@ impl ProxyBroadcastCapture {
         }
         results
     }
+
+    async fn drain_clear_https_certs(&mut self) -> usize {
+        let mut results = 0;
+        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+        loop {
+            match self.rx.try_recv() {
+                Ok(ProxyControlMessage::ClearHttpsCerts) => {
+                    results += 1;
+                }
+                Ok(_) => {}
+                Err(_) => break,
+            }
+        }
+        results
+    }
 }
 
 // Test client builder that exposes the proxy-control receiver.
@@ -120,11 +135,13 @@ async fn make_test_client_with_proxy_rx(
             .unwrap()
             .as_bytes(),
     );
+    let (web_reload_tx, _web_reload_rx) = broadcast::channel::<()>(8);
 
     let webapp = build_webapp(
         tx,
         rx,
         wg_tx,
+        web_reload_tx,
         worker_state,
         pool.clone(),
         key,
@@ -517,7 +534,7 @@ async fn test_external_url_settings_endpoint(_: PgPoolOptions, opts: PgConnectOp
     assert!(saved.proxy_http_cert_key_pem.is_none());
     assert!(saved.proxy_http_cert_expiry.is_none());
     assert!(saved.acme_domain.is_none());
-    assert!(capture.drain_broadcast_certs().await.is_empty());
+    assert_eq!(capture.drain_clear_https_certs().await, 1);
 
     let response = client
         .post("/api/v1/proxy/cert/external_url_settings")
@@ -580,7 +597,10 @@ async fn test_external_url_settings_endpoint(_: PgPoolOptions, opts: PgConnectOp
     assert_eq!(response.status(), StatusCode::CREATED);
 
     let body: serde_json::Value = response.json().await;
-    assert_eq!(body["cert_info"]["common_name"], "uploaded-edge.example.com");
+    assert_eq!(
+        body["cert_info"]["common_name"],
+        "uploaded-edge.example.com"
+    );
 
     let saved = Certificates::get(&pool).await.unwrap().unwrap();
     assert_eq!(saved.proxy_http_cert_source, ProxyCertSource::Custom);
diff --git a/crates/defguard_proxy_manager/src/lib.rs b/crates/defguard_proxy_manager/src/lib.rs
index 5f38640e9c..dd883dc2ce 100644
--- a/crates/defguard_proxy_manager/src/lib.rs
+++ b/crates/defguard_proxy_manager/src/lib.rs
@@ -198,6 +198,21 @@ impl ProxyManager {
                                 }
                             }
                         }
+                        Some(ProxyControlMessage::ClearHttpsCerts) => {
+                            debug!("Broadcasting ClearHttpsCerts to all connected proxies");
+                            let msg = CoreResponse {
+                                id: 0,
+                                payload: Some(core_response::Payload::ClearHttpsCerts(
+                                    defguard_proto::proxy::ClearHttpsCerts {},
+                                )),
+                            };
+                            if let Ok(map) = handler_tx_map.read() {
+                                for (pid, tx) in map.iter() {
+                                    debug!("Sending ClearHttpsCerts to proxy {pid}");
+                                    let _ = tx.send(msg.clone());
+                                }
+                            }
+                        }
                         None => {
                             debug!("Proxy control channel closed");
                             break;
diff --git a/crates/defguard_setup/src/handlers/initial_wizard.rs b/crates/defguard_setup/src/handlers/initial_wizard.rs
index 9a4bdd1e2d..9fe3220bea 100644
--- a/crates/defguard_setup/src/handlers/initial_wizard.rs
+++ b/crates/defguard_setup/src/handlers/initial_wizard.rs
@@ -406,12 +406,12 @@ pub async fn get_ca(_: AdminOrSetupRole, Extension(pool): Extension<PgPool>) ->
 
         Ok(ApiResponse::new(
             json!({
-				"ca_cert_pem": ca_pem,
-				"subject_common_name": info.subject_common_name,
-				"not_before": info.not_before,
-				"not_after": info.not_after,
-				"valid_for_days": valid_for_days
-			}),
+                "ca_cert_pem": ca_pem,
+                "subject_common_name": info.subject_common_name,
+                "not_before": info.not_before,
+                "not_after": info.not_after,
+                "valid_for_days": valid_for_days
+            }),
             StatusCode::OK,
         ))
     } else {
diff --git a/crates/defguard_setup/src/migration.rs b/crates/defguard_setup/src/migration.rs
index 077a755d4f..6903f3611d 100644
--- a/crates/defguard_setup/src/migration.rs
+++ b/crates/defguard_setup/src/migration.rs
@@ -70,6 +70,7 @@ pub fn build_migration_webapp(
     let (webhook_tx, webhook_rx) = mpsc::unbounded_channel::<AppEvent>();
     let (event_tx, event_rx) = mpsc::unbounded_channel::<ApiEvent>();
     let (wireguard_tx, wireguard_rx) = broadcast::channel::<GatewayEvent>(64);
+    let (web_reload_tx, _web_reload_rx) = broadcast::channel::<()>(8);
     let (proxy_control_tx, proxy_control_rx) = mpsc::channel(32);
     let incompatible_components = Arc::new(RwLock::new(IncompatibleComponents::default()));
     let key = Key::from(
@@ -83,6 +84,7 @@ pub fn build_migration_webapp(
         webhook_tx,
         webhook_rx,
         wireguard_tx.clone(),
+        web_reload_tx,
         key,
         failed_logins.clone(),
         event_tx,
diff --git a/proto b/proto
index 0e247a24c3..9f90380336 160000
--- a/proto
+++ b/proto
@@ -1 +1 @@
-Subproject commit 0e247a24c3ae78052501dd052af4b73ab8f1e368
+Subproject commit 9f9038033683b3f07dde88f2fa4e8f7e4a4e9bf9

From 54d1df5d0eeb2b00f8e6681aeb6a122a9e695313 Mon Sep 17 00:00:00 2001
From: Jacek Chmielewski <jacek@defguard.net>
Date: Tue, 7 Apr 2026 13:17:11 +0200
Subject: [PATCH 29/29] defer saving LE state until ACME challenge succeeds

---
 .../src/handlers/component_setup.rs           | 24 +++++++++++++++----
 .../defguard_core/src/handlers/core_certs.rs  |  8 ++-----
 .../tests/integration/api/proxy_certs.rs      |  4 ++--
 .../tests/auto_wizard_url_settings.rs         |  6 ++---
 4 files changed, 27 insertions(+), 15 deletions(-)

diff --git a/crates/defguard_core/src/handlers/component_setup.rs b/crates/defguard_core/src/handlers/component_setup.rs
index a9088b84ac..e2084dae56 100644
--- a/crates/defguard_core/src/handlers/component_setup.rs
+++ b/crates/defguard_core/src/handlers/component_setup.rs
@@ -18,7 +18,7 @@ use defguard_common::{
     db::{
         Id,
         models::{
-            Certificates,
+            Certificates, Settings,
             certificates::ProxyCertSource,
             gateway::Gateway,
             initial_setup_wizard::{InitialSetupState, InitialSetupStep},
@@ -1244,12 +1244,27 @@ pub async fn stream_proxy_acme(
             }
         };
 
-        let domain = match certs.acme_domain.clone() {
-            Some(d) if !d.is_empty() => d,
+        let domain = match Settings::get_current_settings().public_proxy_url.trim() {
+            url if !url.is_empty() => match Url::parse(url)
+                .ok()
+                .and_then(|u| u.host_str().map(ToString::to_string))
+                .filter(|host| !host.is_empty())
+            {
+                Some(host) => host,
+                None => {
+                    yield Ok(acme_error_event(
+                        "Connecting",
+                        "Public proxy URL is not configured with a valid hostname. Please re-submit the external URL settings with a valid domain."
+                            .to_string(),
+                        None,
+                    ));
+                    return;
+                }
+            },
             _ => {
                 yield Ok(acme_error_event(
                     "Connecting",
-                    "No ACME domain configured. Please re-submit the external URL settings \
+                    "Public proxy URL is not configured. Please re-submit the external URL settings \
                      with a Let's Encrypt domain."
                         .to_string(),
                     None,
@@ -1354,6 +1369,7 @@ pub async fn stream_proxy_acme(
                 let acme_cert_expiry = parse_cert_expiry(&cert_pem);
                 match Certificates::get_or_default(&pool).await {
                     Ok(mut updated_certs) => {
+                        updated_certs.acme_domain = Some(domain.clone());
                         updated_certs.proxy_http_cert_pem = Some(cert_pem.clone());
                         updated_certs.proxy_http_cert_key_pem = Some(key_pem.clone());
                         updated_certs.proxy_http_cert_expiry = acme_cert_expiry;
diff --git a/crates/defguard_core/src/handlers/core_certs.rs b/crates/defguard_core/src/handlers/core_certs.rs
index c87c99bf5d..78541bd581 100644
--- a/crates/defguard_core/src/handlers/core_certs.rs
+++ b/crates/defguard_core/src/handlers/core_certs.rs
@@ -218,12 +218,8 @@ pub async fn apply_external_url_settings(
             None
         }
         ExternalSslType::LetsEncrypt => {
-            certs.proxy_http_cert_source = ProxyCertSource::LetsEncrypt;
-            certs.acme_domain = Some(hostname);
-            certs.proxy_http_cert_pem = None;
-            certs.proxy_http_cert_key_pem = None;
-            certs.proxy_http_cert_expiry = None;
-            certs.save(pool).await.map_err(WebError::from)?;
+            // Defer saving the state until ACME challenge succeeds
+            debug!("Validated Let's Encrypt configuration for domain {hostname}");
             None
         }
         ExternalSslType::DefguardCa => {
diff --git a/crates/defguard_core/tests/integration/api/proxy_certs.rs b/crates/defguard_core/tests/integration/api/proxy_certs.rs
index 50928fb5b3..1430afa9f2 100644
--- a/crates/defguard_core/tests/integration/api/proxy_certs.rs
+++ b/crates/defguard_core/tests/integration/api/proxy_certs.rs
@@ -547,8 +547,8 @@ async fn test_external_url_settings_endpoint(_: PgPoolOptions, opts: PgConnectOp
     assert!(body["cert_info"].is_null());
 
     let saved = Certificates::get(&pool).await.unwrap().unwrap();
-    assert_eq!(saved.proxy_http_cert_source, ProxyCertSource::LetsEncrypt);
-    assert_eq!(saved.acme_domain.as_deref(), Some("edge.example.com"));
+    assert_eq!(saved.proxy_http_cert_source, ProxyCertSource::None);
+    assert!(saved.acme_domain.is_none());
     assert!(saved.proxy_http_cert_pem.is_none());
     assert!(capture.drain_broadcast_certs().await.is_empty());
 
diff --git a/crates/defguard_setup/tests/auto_wizard_url_settings.rs b/crates/defguard_setup/tests/auto_wizard_url_settings.rs
index c022582182..16cd360698 100644
--- a/crates/defguard_setup/tests/auto_wizard_url_settings.rs
+++ b/crates/defguard_setup/tests/auto_wizard_url_settings.rs
@@ -259,7 +259,7 @@ async fn test_external_url_settings_all_ssl_types(_: PgPoolOptions, options: PgC
     assert_eq!(certs.proxy_http_cert_source, ProxyCertSource::None);
     assert!(certs.proxy_http_cert_pem.is_none());
 
-    // ssl_type = lets_encrypt: stores ACME domain, does not issue cert yet
+    // ssl_type = lets_encrypt: validates settings, does not issue or persist cert state yet
     let resp = client
         .post("/api/v1/initial_setup/auto_wizard/external_url_settings")
         .json(
@@ -271,8 +271,8 @@ async fn test_external_url_settings_all_ssl_types(_: PgPoolOptions, options: PgC
     assert_eq!(resp.status(), StatusCode::CREATED);
 
     let certs = Certificates::get_or_default(&pool).await.unwrap();
-    assert_eq!(certs.proxy_http_cert_source, ProxyCertSource::LetsEncrypt);
-    assert_eq!(certs.acme_domain.as_deref(), Some("proxy.example.com"));
+    assert_eq!(certs.proxy_http_cert_source, ProxyCertSource::None);
+    assert!(certs.acme_domain.is_none());
     assert!(certs.proxy_http_cert_pem.is_none());
     assert!(certs.proxy_http_cert_key_pem.is_none());