The certificate the management web UI presents over HTTPS. Choose how it is provisioned — import your own chain and key, generate a self-signed cert, emit a CSR to sign with your own CA, or have ACME (Let's Encrypt) issue and renew one. A live rotation must be confirmed within a short window or it reverts automatically, so a bad certificate cannot lock you out of management.