Back up /root/cert alongside letsencrypt, and on restore recreate the webCertFile symlinks from the DB for older backups that lack them — without them x-ui serves plain HTTP and every nginx proxy_pass https:// (panel + diag bridge) breaks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>