diff --git a/README.md b/README.md
index eaea3818..ffb68ffc 100644
--- a/README.md
+++ b/README.md
@@ -61,7 +61,7 @@ docker compose version
 - `docker compose pull` if you want to use pre-built images or `docker compose build` if you want to build your own (see the [Troubleshooting](#troubleshooting) section in case of errors)
 - `docker compose up`
   - Add `-d` to run the services in the background
-- Login to `https://localhost`
+- Login to `http://localhost`
   - User: `admin@admin.test`
   - Password: `admin`
 
@@ -366,8 +366,12 @@ This improves security and scalability of the front-facing NGINX server but lead
 |                           |                                                          |
 | `DISABLE_SSL_REDIRECT`    | Removed entirely, SSL is auto-detected via cert presence |
 
+**Base URL:** The BASE_URL variable is now mandatory because the SSL logic is changed (see below). Please make sure it is in your environment.
+
 **TLS/SSL:** The existing `./ssl` volume mount from `misp-core` is moved to the `misp-nginx` container, so existing certificates keep working.
 
+**Certificates:** SSL is disabled if certificates are missing, but you can generate self-signed certificates with the following command: `mkdir -p ./ssl/ && openssl req -x509 -subj '/CN=localhost' -nodes -newkey rsa:4096 -keyout ssl/key.pem -out ssl/cert.pem -days 365 -addext "subjectAltName = DNS:localhost, IP:127.0.0.1, IP:::1"`
+
 **GPG key delivery:** `gpg.asc` is now served via `misp-nginx`, which proxies the request through to `misp-core` (PHP-FPM) rather than serving a static file from the webroot path.
 
 **Kubernetes/Helm:** manifests have been updated for the new two-container topology; if you deploy via Helm/Kubernetes, review the updated chart before upgrading.
diff --git a/core/files/entrypoint.sh b/core/files/entrypoint.sh
index 9790569b..b4a05e79 100755
--- a/core/files/entrypoint.sh
+++ b/core/files/entrypoint.sh
@@ -32,9 +32,8 @@ if [ "$ENABLE_REDIS_EMPTY_PASSWORD" = "true" ]; then
 else
     export REDIS_PASSWORD=${REDIS_PASSWORD:-redispassword}
 fi
-export BASE_URL=${BASE_URL:-https://localhost}
+export BASE_URL=${BASE_URL}
 export DISABLE_IPV6=${DISABLE_IPV6:-false}
-export DISABLE_SSL_REDIRECT=${DISABLE_SSL_REDIRECT:-false}
 export DISABLE_CA_REFRESH=${DISABLE_CA_REFRESH:-false}
 export SMTP_FQDN=${SMTP_FQDN:-mail}
 export SMTP_PORT=${SMTP_PORT:-25}
@@ -70,10 +69,6 @@ export PROXY_ENABLE=${PROXY_ENABLE:-false}
 export DEBUG=${DEBUG:-0}
 export ENABLE_THEMES=${ENABLE_THEMES:-false}
 
-export FASTCGI_READ_TIMEOUT=${FASTCGI_READ_TIMEOUT:-300s}
-export FASTCGI_SEND_TIMEOUT=${FASTCGI_SEND_TIMEOUT:-300s}
-export FASTCGI_CONNECT_TIMEOUT=${FASTCGI_CONNECT_TIMEOUT:-300s}
-
 export PHP_LISTEN_FPM=true
 export PHP_FCGI_CHILDREN=${PHP_FCGI_CHILDREN:-5}
 export PHP_FCGI_START_SERVERS=${PHP_FCGI_START_SERVERS:-2}
@@ -98,10 +93,6 @@ export PHP_SESSION_COOKIE_SAMESITE=${PHP_SESSION_COOKIE_SAMESITE:-Lax}
 
 export TZ=${TZ:-UTC}
 
-export NGINX_X_FORWARDED_FOR=${NGINX_X_FORWARDED_FOR:-false}
-export NGINX_SET_REAL_IP_FROM=${NGINX_SET_REAL_IP_FROM}
-export NGINX_CLIENT_MAX_BODY_SIZE=${NGINX_CLIENT_MAX_BODY_SIZE:-50M}
-
 export STUNNEL=${STUNNEL:-false}
 export STUNNEL_CONFIG=${STUNNEL_CONFIG}
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 2ccdf781..e79dccc5 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -122,7 +122,7 @@ services:
       interval: 2s
       timeout: 1s
       retries: 3
-      start_period: 30s
+      start_period: 60s
       start_interval: 30s
     expose:
       - 9002
@@ -139,14 +139,13 @@ services:
     # mount custom ca root certificates
     # - "./rootca.pem:/usr/local/share/ca-certificates/rootca.crt:Z"
     environment:
-      - "BASE_URL=${BASE_URL}"
+      - "BASE_URL=${BASE_URL:?The BASE_URL variable is now mandatory because the SSL logic is changed, see README.md for instructions.}"
       - "CRON_USER_ID=${CRON_USER_ID}"
       - "CRON_PULLALL=${CRON_PULLALL}"
       - "CRON_PUSHALL=${CRON_PUSHALL}"
       - "FETCH_FEED_INTERVAL=${FETCH_FEED_INTERVAL}"
       - "CACHE_FEED_INTERVAL=${CACHE_FEED_INTERVAL}"
       - "DISABLE_IPV6=${DISABLE_IPV6}"
-      - "DISABLE_SSL_REDIRECT=${DISABLE_SSL_REDIRECT}"
       - "ENABLE_DB_SETTINGS=${ENABLE_DB_SETTINGS}"
       - "AUTH_ENFORCED=${AUTH_ENFORCED}"
       - "ENABLE_BACKGROUND_UPDATES=${ENABLE_BACKGROUND_UPDATES}"
@@ -357,7 +356,7 @@ services:
       - ALL
     environment:
       - "TZ=${TZ}"
-      - "BASE_URL=${BASE_URL}"
+      - "BASE_URL=${BASE_URL:?The BASE_URL variable is now mandatory because the SSL logic is changed, see README.md for instructions.}"
       - "DISABLE_IPV6=${DISABLE_IPV6}"
       # NGINX settings
       - "NGINX_X_FORWARDED_FOR=${NGINX_X_FORWARDED_FOR}"
diff --git a/experimental/podman-systemd/misp-core.container b/experimental/podman-systemd/misp-core.container
index 8dc384da..6b8accea 100644
--- a/experimental/podman-systemd/misp-core.container
+++ b/experimental/podman-systemd/misp-core.container
@@ -17,7 +17,7 @@ Volume=misp-core_gpg.volume:/var/www/MISP/.gnupg/
 Volume=misp-core_certs.volume:/etc/nginx/certs/
 Volume=misp-core_logs.volume:/var/www/MISP/app/tmp/logs/
 EnvironmentFile=misp.env
-HealthCmd=curl -ks ${BASE_URL:-https://localhost}/users/heartbeat > /dev/null || exit 1
+HealthCmd=curl -ks ${BASE_URL:-http://localhost}/users/heartbeat > /dev/null || exit 1
 HealthInterval=2s
 HealthTimeout=1s
 HealthRetries=3
diff --git a/kubernetes/helm-chart/files/custom/customize_misp.sh b/kubernetes/helm-chart/files/custom/customize_misp.sh
index 5aabdd65..5175c7f9 100644
--- a/kubernetes/helm-chart/files/custom/customize_misp.sh
+++ b/kubernetes/helm-chart/files/custom/customize_misp.sh
@@ -13,7 +13,7 @@ echo "Starting custom MISP configuration..."
 echo "Waiting for MISP to be ready..."
 
 # First check basic HTTP response
-while ! curl -s -k "${BASE_URL:-https://localhost}/users/heartbeat" > /dev/null; do
+while ! curl -s -k "${BASE_URL:-http://localhost}/users/heartbeat" > /dev/null; do
     echo "Waiting for MISP HTTP response..."
     sleep 10
 done
@@ -55,9 +55,9 @@ set_misp_setting() {
     local setting_name="$1"
     local setting_value="$2"
     local description="$3"
-    
+
     echo "Setting ${description}: ${setting_name}=${setting_value}"
-    
+
     # Use cake command (should work now since MISP is fully ready)
     if ./app/Console/cake Admin setSetting "${setting_name}" "${setting_value}"; then
         echo "✓ Successfully set ${setting_name} via cake command"
@@ -111,4 +111,4 @@ echo "MISP | Configure background jobs ..." && configure_background_jobs
 echo "MISP | Restarting workers ..." && supervisorctl -u "${SUPERVISOR_USERNAME}" -p "${SUPERVISOR_PASSWORD}" restart misp-workers:*
 # echo "MISP | Run custom Python scripts ..." && run_custom_python_scripts
 
-echo "Custom MISP configuration completed successfully!"
\ No newline at end of file
+echo "Custom MISP configuration completed successfully!"
diff --git a/nginx/files/00-misp.envsh b/nginx/files/00-misp.envsh
index 46e7f3a1..42902972 100755
--- a/nginx/files/00-misp.envsh
+++ b/nginx/files/00-misp.envsh
@@ -2,7 +2,7 @@
 # -*- coding: utf-8 -*-
 
 export TZ="${TZ:-UTC}"
-export BASE_URL="${BASE_URL:-https://localhost}"
+export BASE_URL="${BASE_URL}"
 export DISABLE_IPV6="${DISABLE_IPV6:-false}"
 
 export NGINX_X_FORWARDED_FOR="${NGINX_X_FORWARDED_FOR:-false}"
diff --git a/template.env b/template.env
index 21e6b5f9..6e4f4c02 100644
--- a/template.env
+++ b/template.env
@@ -61,9 +61,9 @@ ADMIN_PASSWORD=
 GPG_PASSPHRASE=
 # defaults to 1 (the admin user)
 CRON_USER_ID=
-# defaults to 'https://localhost'
-# note: if you are exposing MISP on a non-standard port (i.e., the port is part of the URL you would use to access it, e.g., https://192.168.0.1:4433) you need to include the port in the BASE_URL variable
-BASE_URL=
+# defaults to 'http://localhost'
+# note: if you are exposing MISP on a non-standard port (i.e., the port is part of the URL you would use to access it, e.g., http://192.168.0.1:4433) you need to include the port in the BASE_URL variable
+BASE_URL=http://localhost
 # NGINX_HTTP_PORT=80
 # NGINX_HTTPS_PORT=443
 # store settings in db except those that must stay in config.php. true/false, defaults to false