diff --git a/web/src/components/ServicesComponent.tsx b/web/src/components/ServicesComponent.tsx
index b28a932..e1cee43 100644
--- a/web/src/components/ServicesComponent.tsx
+++ b/web/src/components/ServicesComponent.tsx
@@ -21,20 +21,22 @@ import { usePageHelp } from '../hooks/usePageHelp';
 import type { RegisteredService } from '../services/api/networking';
 import { servicesApi, haproxyApi } from '../services/api/networking';
 
-function StatusDot({ status, label }: { status: 'ok' | 'warning' | 'na'; label: string }) {
+function StatusDot({ status, label }: { status: 'ok' | 'error' | 'na'; label: string }) {
   return (
     <span className="inline-flex items-center gap-1 text-xs">
       {status === 'ok' && <CheckCircle className="h-3.5 w-3.5 text-green-500" />}
-      {status === 'warning' && <AlertCircle className="h-3.5 w-3.5 text-amber-500" />}
-      {status === 'na' && <span className="h-3.5 w-3.5 text-muted-foreground inline-flex items-center justify-center">&mdash;</span>}
+      {status === 'error' && <AlertCircle className="h-3.5 w-3.5 text-red-500" />}
+      {status === 'na' && <CheckCircle className="h-3.5 w-3.5 text-muted-foreground" />}
       <span className="text-muted-foreground">{label}</span>
     </span>
   );
 }
 
-function getTlsStatus(service: RegisteredService, certDomains: Set<string>): 'ok' | 'warning' | 'na' {
-  if (service.tls === 'passthrough' || service.backend.type === 'tcp-passthrough') return 'ok';
-  return certDomains.has(service.domain) ? 'ok' : 'warning';
+function getTlsStatus(service: RegisteredService, certDomains: Set<string>): 'ok' | 'error' | 'na' {
+  // Passthrough: Central doesn't handle TLS — grey (not applicable)
+  if (service.tls === 'passthrough' || service.backend.type === 'tcp-passthrough') return 'na';
+  // Terminate: Central handles TLS — green if cert exists, red if missing
+  return certDomains.has(service.domain) ? 'ok' : 'error';
 }
 
 function getProxyLabel(service: RegisteredService): string {