Creating a custom certificate

The following description is augmented with example calls using OpenSSL in a linux terminal.

  1. Create a private key for your certificate: openssl genrsa -out certificate-key.pem 4096
  2. For the certificate signing request (CSR), create a configuration file req.conf in the same folder where you execute the OpenSSL commands.
  3. Paste the following configuration into req.conf:

  4. [req]

    distinguished_name = req_distinguished_name

    req_extensions = v3_req

    prompt = no

    [req_distinguished_name]

    C = <COUNTRY_CODE>

    ST = <STATE>

    L = <LOCATION>

    O = <YOUR_ORGANISATION>

    CN = <IP-ADDRESS>

    [v3_req]

    keyUsage = keyEncipherment, dataEncipherment, digitalSignature

    extendedKeyUsage = serverAuth

    subjectAltName = @alt_names

    [alt_names]

    IP.1 = <IP-ADDRESS>

    IP.2 = 192.168.10.202

  5. Replace <COUNTRY_CODE>, <STATE>, <LOCATION> and <YOUR_ORGANISATION> with the desired values.
  6. Replace both properties <IP-ADDRESS> with the IP address of your device.
  7. Create the CSR: openssl req -new -key certificate-key.pem -out certificate.csr -sha512 -config req.conf
  8. notice

    The CSR must be signed by a certificate authority (CA) that your browser trusts. You can either give the CSR to a well-known CA your browser trusts by default or use a custom CA to sign your CSR.

  9. If you give the CSR to a well-known CA, you will get back a signed certificate. You can upload the certificate.
  10. If you want to sign the CSR with a custom or enterprise CA, proceed as follows.
  11. Sign the CSR with a private key of a custom CA: openssl x509 -req -in certificate.csr -CA <CA_ROOT.PEM> -CAkey <CA_KEY.PEM> -CAcreateserial -out certificate-pub.pem -days 365 -sha512 -extfile req.conf -extensions v3_req
  12. Replace <CA_ROOT.PEM> and <CA_KEY.PEM> with the certificate and private key of the trusted CA.
  13. notice

    If the CA is not included in the list of trusted CAs in your browser, you have to add the CA to the browser's trusted CA list.

Uploading a custom certificate