Yes, I understand that, but the reason behind the need for securing the web UI eludes me. It could be something like @jvanasco mentioned.. It could also be totally not worth the effort.
If this is your only usage, IMHO:
- It is absolutely not worth the hassle of getting a Trusted Certificate (from LetsEncrypt or anyone else). I'm a more advanced user of SSL tools than the general public, and this sort of stuff is easy for me.
- I would possibly use a self-signed certificate
- I would probably just leave it as http
yeah, suppose to leave it at http will be best
thanks guys for trying to help me out anyway
I run one of those clients (for dns-01 challenges). It only takes a CSR, not your private key. It is for this type of interface that your graphical certificate screen was designed. Everything @Osiris has mentioned applies. There are also other ramifications, but they probably won't affect you too much:
You can click on my icon to see the link in my profile if you are interested in this route.
The option above that is much better:
Could you explain why that's better under local circumstances and assuming there aren't any clients requiring HTTPS? What's the added benifit? A green lock in your browser? Your sister not being able to ARP spoof your switch so she can't see you're watching pr0n? (Why is that on your locally available NAS anyway? 
)
Because HTTPS is always better than HTTP.
The whole "I've got nothing anyone wants" or "I've got nothing to hide" ...
Won't prevent malice - which can and will happen whenever/wherever possible.
Is any part of the Internal network on WiFi (is that secure)?
Does any part of the Internal network operate "smart devices"?
Hello Alexa, Google, Siri, TV, refrigerator, ... "Is my network secure?"
Is there an IPS in place?
Does it do HTTPS inspection?
Assuming "secure" as the default is a doomed to fail approach.
So the "benefit", to me, is being able to sleep at night - not that I ever sleep, I just like being able to.
-- only the paranoid will survive --
HTTPS has a performance penalty, however slightly. Also, I said I assumed the internal network was secure. So no Alexa, no usage of WiFi et cetera.
Personally, I always like to think and act rationally. Not emotionally and especially not from some kind of psychiatric disorder 
Not always.
And I'm not sure he will be using HTTPS for upload/downloads - just WebUI/management
And I said:
Then we are NOT so different after all.
Does the app-based configuration panel, as illustrated in screenshots above, encrypt traffic? Probably not. Does the NAS encrypt traffic when working as a mounted volume? Probably not. Is there a setting on the control panel to drop HTTP support and only respond to HTTPS? Probably not.
There are a few edge cases for locking down a NAS control panel within a private LAN using a self-signed certificate, but it is not necessarily going to bring any additional security and may introduce new attack vectors (that cert may be accepted into the user's computer's trust store).
Maybe the NAS is exposed publicly or needs cert for Media Streaming. Those are definite HTTPS NOW! situations. If it is only being used to secure a control panel though, why bother?
I have a box with a lock on it...
But it is always in my locked house...
Should I ever lock it?
If your box is anything like the NAS peculiarities I mentioned above, the lid isn't attached to the box and your lock is purely decorative and serves no functional purpose.
hi guys,
to reply to your question, i hope this screenshot gives you the answer.
(the lower tick box says = allow HTTPS only)
and yes, the NAS provides the possibility to have media streaming on my smartphone(s) (app called Zcloud) that can have http or https connection to the server.
oh, BTW : i send a mail to ZYXEL and told them their entire SSL pages are useless since they can't produce a valid certificate to use ( and gave the hint to include let's encrypt clients )
and to finish ( please don't laugh, but you guys will do anyway) i feel like the new kid in town, dumped by the wizkids straight the first day in school. But at least you try to keep high tech talk to a minimum to me.(thank you for that)
I can get you a certificate in minutes. Did you read my post? I'm more than happy to help. You're supposed to use their page with a CA CSR input page, which is what I have.
yes, i read your post.
and it would be great to get a valid cerrtificate. so i'm taking you up on your offer.
what do you need exactly from me to make the certificate?
Do you have a public DNS for the domain associated with your device that you can add some TXT records to?
i have 2 domains : mentioned at the top of the topic.
my device is not associated with any domain as far as i can tell. (that is done with the creation of the certificate, no? cause that is the only place where domain and device are in the same place ( see pic2 above)
and adding text records? no idea how or where to do such
if i provide you with the created signing request, can you use that ?
Yes.
A certificate certifies the domain name(s) and associates a public key (contained in the CSR). In order to prove your ownership of the domain name(s) you'll need to create a specific TXT record in the DNS for each name. Typically you could do this through your registrar for the domain name(s). In order for the certificate to work once you get it, you must install it on your device (through the pages you have). The device must be configured to answer to at least one of the domain names on the certificate. It does not even need to be externally accessible. It just needs to be reachable however you reach it by that name. Make sense?
have to reread it few times to fully grab it, but i get the general notion, as said, i'm the new kid here.
how do i send you the request file(s)?
can't do it here