Option 1 — Import a certificate you already own (recommended)

If your customer or organization has a TLS certificate (from a public CA like
DigiCert, Sectigo, or Let's Encrypt) for the hostname or IP of this box, you
can load it directly through the UI:

1. Log in to the BNG management interface.
2. Navigate to About → Manage TLS cert → Import existing tab.
3. Paste or upload your certificate (PEM format) and private key.
4. Click Apply. The service reloads the certificate in-place — no restart needed.

After import, any browser that already trusts the issuing CA will connect
without a warning. This is the right approach for production deployments where
a certificate exists.