troubleshooting : add webgui recovery help, ipsec: explain async crypto a bit better

source/manual/vpnet.rst

@@ -252,7 +252,9 @@ Tuning considerations
 .................................
 
 Depending on the workload (many different IPsec flows or a single flow), it might help to enable multithreaded crypto mode
-on :code:`ipsec`, in which case cryptographic packets are dispatched to multiple processors.
+on :code:`ipsec`, in which case cryptographic packets are dispatched to multiple processors (especially when only a single
+tunnel is being used).
+
 In order to do so, add or change the following tunable in :menuselection:`System --> Settings --> Tunables`:
 
 .. Note::

source/troubleshooting.rst

@@ -72,6 +72,7 @@ be found in the list below.
    :glob:
 
    troubleshooting/password_reset
+   troubleshooting/webgui
    troubleshooting/boot
    troubleshooting/hardening
    troubleshooting/gateways

source/troubleshooting/webgui.rst

@@ -0,0 +1,19 @@
+====================================
+WebGui access reset
+====================================
+
+If for some reason the webgui certificate is broken, you can reconfigure access using the console menu.
+Select :code:`Set interface IP address` (option 2) from the menu, reconfigure an interface, after providing the
+address configuration you can either (temporary) switch back to :code:`HTTP` or in the next step generate a new self-signed certificate.
+
+It is also possible to reset the defaults in the final step ("**Restore web GUI access defaults?**"),
+in case something went wrong while setting up anti lockout policies or after changing interfaces.
+
+
+.. Tip::
+    When logged in directly via a console or shell, you can also use the following command to generate a new self-signed certificate
+    and restart the web ui:
+
+    :code:`configctl webgui restart renew``
+
+