diff --git a/flutter/lib/desktop/widgets/update_progress.dart b/flutter/lib/desktop/widgets/update_progress.dart
index bde306316..879ecd745 100644
--- a/flutter/lib/desktop/widgets/update_progress.dart
+++ b/flutter/lib/desktop/widgets/update_progress.dart
@@ -65,7 +65,8 @@ void handleUpdate(String releasePageUrl) {
 }
 
 void _showUpdateError(String releasePageUrl, String error,
-    {bool showRetry = true}) {
+    {String messageKey = 'download-new-version-failed-tip',
+    bool showRetry = true}) {
   debugPrint('Update error: $error');
   final dialogManager = gFFI.dialogManager;
 
@@ -88,8 +89,7 @@ void _showUpdateError(String releasePageUrl, String error,
           mainAxisSize: MainAxisSize.min,
           crossAxisAlignment: CrossAxisAlignment.start,
           children: [
-            msgboxContent('custom-nocancel-nook-hasclose', 'Error',
-                'download-new-version-failed-tip'),
+            msgboxContent('custom-nocancel-nook-hasclose', 'Error', messageKey),
             const SizedBox(height: 8),
             Text(error),
           ],
@@ -270,7 +270,7 @@ class UpdateProgressState extends State<UpdateProgress> {
           }
           if (evt.containsKey('error')) {
             _showUpdateError(widget.releasePageUrl, evt['error'] as String,
-                showRetry: false);
+                messageKey: 'Failed', showRetry: false);
           }
         }, replace: true);
         bind.mainSetCommon(key: 'update-me', value: widget.downloadUrl);
diff --git a/src/hbbs_http/http_client.rs b/src/hbbs_http/http_client.rs
index bd732bfcd..352982276 100644
--- a/src/hbbs_http/http_client.rs
+++ b/src/hbbs_http/http_client.rs
@@ -120,6 +120,15 @@ pub fn get_url_for_tls<'a>(url: &'a str, proxy_conf: &'a Option<Socks5Server>) -
     url
 }
 
+/// Creates a sync HTTP client for `url`.
+///
+/// `tls_danger_accept_invalid_cert` has three states:
+/// - `None`: use cached TLS backend/cert settings when present; otherwise allow
+///   automatic fallback between Rustls/NativeTls and strict/accept-invalid modes.
+/// - `Some(false)`: force strict certificate validation, overriding the cache;
+///   use for security-critical requests such as updates.
+/// - `Some(true)`: force accepting invalid certificates, overriding the cache;
+///   use sparingly.
 pub fn create_http_client_with_url(
     url: &str,
     tls_danger_accept_invalid_cert: Option<bool>,
@@ -233,6 +242,15 @@ fn create_http_client_with_url_(
     client
 }
 
+/// Creates an async HTTP client for `url`.
+///
+/// `tls_danger_accept_invalid_cert` has three states:
+/// - `None`: use cached TLS backend/cert settings when present; otherwise allow
+///   automatic fallback between Rustls/NativeTls and strict/accept-invalid modes.
+/// - `Some(false)`: force strict certificate validation, overriding the cache;
+///   use for security-critical requests such as updates.
+/// - `Some(true)`: force accepting invalid certificates, overriding the cache;
+///   use sparingly.
 pub async fn create_http_client_async_with_url(
     url: &str,
     tls_danger_accept_invalid_cert: Option<bool>,