diff --git a/source/manual/vpnet.rst b/source/manual/vpnet.rst
index 48111729..4e917b11 100644
--- a/source/manual/vpnet.rst
+++ b/source/manual/vpnet.rst
@@ -252,7 +252,9 @@ Tuning considerations
 .................................
 
 Depending on the workload (many different IPsec flows or a single flow), it might help to enable multithreaded crypto mode
-on :code:`ipsec`, in which case cryptographic packets are dispatched to multiple processors.
+on :code:`ipsec`, in which case cryptographic packets are dispatched to multiple processors (especially when only a single
+tunnel is being used).
+
 In order to do so, add or change the following tunable in :menuselection:`System --> Settings --> Tunables`:
 
 .. Note::
diff --git a/source/troubleshooting.rst b/source/troubleshooting.rst
index 897a069c..cb87230d 100644
--- a/source/troubleshooting.rst
+++ b/source/troubleshooting.rst
@@ -72,6 +72,7 @@ be found in the list below.
    :glob:
 
    troubleshooting/password_reset
+   troubleshooting/webgui
    troubleshooting/boot
    troubleshooting/hardening
    troubleshooting/gateways
diff --git a/source/troubleshooting/webgui.rst b/source/troubleshooting/webgui.rst
new file mode 100644
index 00000000..3845808a
--- /dev/null
+++ b/source/troubleshooting/webgui.rst
@@ -0,0 +1,19 @@
+====================================
+WebGui access reset
+====================================
+
+If for some reason the webgui certificate is broken, you can reconfigure access using the console menu.
+Select :code:`Set interface IP address` (option 2) from the menu, reconfigure an interface, after providing the
+address configuration you can either (temporary) switch back to :code:`HTTP` or in the next step generate a new self-signed certificate.
+
+It is also possible to reset the defaults in the final step ("**Restore web GUI access defaults?**"),
+in case something went wrong while setting up anti lockout policies or after changing interfaces.
+
+
+.. Tip::
+    When logged in directly via a console or shell, you can also use the following command to generate a new self-signed certificate
+    and restart the web ui:
+
+    :code:`configctl webgui restart renew``
+
+