Why your browser says your localhost site is not secure

That warning appears because your browser doesn't yet trust whoever signed the site's certificate. Server by Zaweba signs each local site's certificate with its own local certificate authority, and until that authority is in your trusted list the browser treats the site as unverified. Use the command to trust the local HTTPS certificate authority, confirm the Windows prompt, and Edge and Chrome accept the sites from then on.

Nothing is actually wrong with the site. The connection is still encrypted. The browser is saying it can't confirm who issued the certificate, which is exactly what it should say about any authority it hasn't been told about.

How certificates are trusted

A browser trusts a site's certificate when it was signed by an authority on a trusted list. Public websites use authorities that are on that list already. A site on your own PC can't get a certificate from them, so local development tools make their own authority instead.

Server does this when you turn on HTTPS for a site with the switch in the sites list. It creates a local certificate authority and makes a certificate for each site covering name.test, www.name.test and name.localhost. The site certificates last 825 days. All that's missing is one step: telling Windows that this authority is yours and can be trusted.

Fixing it in Edge and Chrome

Use Tools, then Trust the local HTTPS certificate authority. The same command is a button in Settings. Server explains in plain words what it's about to do, then adds the authority to your own Windows Trusted Root store. Windows shows a security prompt of its own to confirm, which is expected.

Once that's done, Edge and Chrome accept the sites' certificates and the padlock shows normally. If a tab was already open with the warning, reload it, or close and reopen the browser if it held on to the old answer.

Why Firefox still complains

Firefox keeps its own list of trusted authorities rather than using the one in Windows. Trusting the authority in Windows doesn't reach it, so it needs the authority file imported by hand. The file is rootCA.pem in Server's data\ca folder, and Settings can open the certificates folder so you don't have to find it. Import it in Firefox's certificate settings as an authority for identifying websites.

Is it safe to trust it?

The authority is made on your PC and kept in Server's own folder. It exists to sign certificates for your local sites, and those sites listen on 127.0.0.1 only, so nothing outside your computer can reach them. Server explains this before it asks, and Windows asks you to confirm, so nothing happens behind your back.

Treat the certificates folder like any other private file. Don't share it or upload it with a website.

Other reasons for a warning

If you've trusted the authority and still see a warning, check the address. The certificate covers name.test, www.name.test and name.localhost, so another name won't match. Check too that HTTPS is switched on for that site in the sites list, and that you're using the https address the site card shows. If Server moved HTTPS to another port because the usual one was taken, the address includes that port.

A plain http address will also be marked not secure by most browsers, because nothing is encrypted at all. That's normal for local work, and if it bothers you, switching HTTPS on for the site sorts it out.

Once the authority is trusted, every site you make in Server by Zaweba with HTTPS on works without another click, so it's a one-off job.