diff --git a/README.md b/README.md
index f1f204e..8a4db57 100644
--- a/README.md
+++ b/README.md
@@ -272,6 +272,7 @@ HaRP is configured via several environment variables. Here are the key variables
     - `HP_EXAPPS_ADDRESS="0.0.0.0:8780"`
     - `HP_EXAPPS_HTTPS_ADDRESS="0.0.0.0:8781"`
   - **Note:** Must be reachable by your reverse proxy.
+  - **Note:** The HTTPS frontend is enabled only when `/certs/cert.pem` (certificate and private key in one PEM file) exists.
 
 - **`HP_TRUSTED_PROXY_IPS`**
   - **Description:** A comma-separated list of trusted reverse proxy IP addresses or CIDR ranges. When HaRP is behind another reverse proxy (like NGINX), set this to the IP of that proxy to allow HaRP to correctly identify the true client IP from `X-Forwarded-For` or `X-Real-IP` headers.
diff --git a/start.sh b/start.sh
index ece4368..bab9d96 100644
--- a/start.sh
+++ b/start.sh
@@ -354,6 +354,12 @@ fi
 if [ -f "${CFG_DIR}/haproxy.cfg" ]; then
   log "INFO: ${CFG_DIR}/haproxy.cfg already present. Skipping config generation..."
 else
+  # Checked before the config is written, so a failed start leaves none for a restart to reuse.
+  if [ -f "/certs/cert.pem" ] && [ ! -r "/certs/cert.pem" ]; then
+    echo "ERROR: /certs/cert.pem is not readable by uid $(id -u); make it readable, or remove it to disable the HTTPS frontend."
+    exit 1
+  fi
+
   log "INFO: Creating ${CFG_DIR}/haproxy.cfg from haproxy.cfg.template..."
 
   # Use envsubst to render the main configuration.
@@ -363,7 +369,6 @@ else
   if [ -f "/certs/cert.pem" ]; then
     log "INFO: Found /certs/cert.pem, HTTPS frontends remain enabled."
     sed -i "/_HTTPS_FRONTEND_/ s|_HTTPS_FRONTEND_ ||g" "${CFG_DIR}/haproxy.cfg"
-    chmod 644 /certs/cert.pem
   else
     log "INFO: No /certs/cert.pem found, disabling HTTPS frontends..."
     sed -i "/_HTTPS_FRONTEND_/ s|^|#|g" "${CFG_DIR}/haproxy.cfg"