> ## Documentation Index
> Fetch the complete documentation index at: https://documentation.bearsampp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable HTTPS and SSL Certificates in Bearsampp

> Learn how to generate SSL certificates and enable HTTPS for Apache in Bearsampp, including self-signed certificates for local development.

Bearsampp includes built-in SSL support for Apache, letting you serve your local sites over HTTPS without installing any external tools. SSL certificates are generated using OpenSSL, which is bundled with Bearsampp. When you create a virtual host, Bearsampp generates an SSL certificate for it automatically — or you can generate a certificate manually at any time.

## Where certificates are stored

All generated SSL certificates are saved in the `ssl/` folder inside your Bearsampp directory:

```
bearsampp\ssl\
```

Each certificate consists of two files named after the server name you chose:

* `servername.crt` — the certificate file
* `servername.key` — the private key file

## Generate an SSL certificate manually

You can generate a certificate for any hostname directly from the tray menu.

<Steps>
  <Step title="Right-click the Bearsampp tray icon">
    Find the Bearsampp icon in your Windows system tray and right-click it.
  </Step>

  <Step title="Open the Apache menu">
    Hover over **Apache** in the context menu.
  </Step>

  <Step title="Click Generate SSL certificate">
    Click **Generate SSL certificate**. A dialog opens with two fields.
  </Step>

  <Step title="Enter the server name">
    In the **Name** field, type the hostname you want the certificate for (e.g. `myapp.local`). The dialog pre-fills `test.local` as a placeholder.
  </Step>

  <Step title="Choose an output folder">
    The **Target** field defaults to `bearsampp\ssl\`. Click **Browse** to choose a different output folder, or leave the default.
  </Step>

  <Step title="Click Save">
    Click **Save**. Bearsampp generates the `.crt` and `.key` files in the target folder.
  </Step>
</Steps>

## SSL and virtual hosts

When you add a virtual host using the tray menu, Bearsampp automatically generates an SSL certificate for that virtual host's server name and stores it in `bearsampp\ssl\`. You do not need to generate the certificate separately.

See [Virtual Hosts](/configuration/virtual-hosts) for instructions on creating a virtual host.

## Default SSL port

Apache's default HTTPS port is `443`. You can change it from the tray menu like any other port — see [Change Service Ports](/configuration/ports).

## Trusting the certificate in your browser

Bearsampp generates **self-signed** certificates. Browsers do not trust self-signed certificates by default, so you will see a security warning the first time you visit an HTTPS site using a Bearsampp certificate.

You have two options:

<CardGroup cols={2}>
  <Card title="Accept the warning" icon="shield-exclamation">
    In most browsers, you can click **Advanced** and then **Proceed to \[hostname]** to continue past the warning. This is the quickest option for local development.
  </Card>

  <Card title="Add to trust store" icon="certificate">
    Import the `.crt` file into Windows' Certificate Manager as a trusted root authority. This removes the browser warning permanently for that certificate.
  </Card>
</CardGroup>

### Adding a certificate to the Windows trust store

<Steps>
  <Step title="Open the certificate file">
    Navigate to `bearsampp\ssl\` and double-click the `.crt` file for your hostname.
  </Step>

  <Step title="Install the certificate">
    Click **Install Certificate**, choose **Local Machine**, and click **Next**.
  </Step>

  <Step title="Choose the certificate store">
    Select **Place all certificates in the following store**, click **Browse**, and choose **Trusted Root Certification Authorities**.
  </Step>

  <Step title="Complete the wizard">
    Click **Next**, then **Finish**. Restart your browser for the change to take effect.
  </Step>
</Steps>

<Warning>
  Self-signed certificates are suitable for local development only. Never use them to serve public-facing sites.
</Warning>