# Creating a custom certificate

The following description is augmented with example calls using OpenSSL in a linux terminal.

1. Create a private key for your certificate: `openssl genrsa -out certificate-key.pem 4096`
2. For the certificate signing request (CSR), create a configuration file req.conf in the same folder where you execute the OpenSSL commands.
3. Paste the following configuration into req.conf:

4. `[req]`

   `distinguished_name = req_distinguished_name`

   `req_extensions = v3_req`

   `prompt = no`

   `[req_distinguished_name]`

   `C = <COUNTRY_CODE>`

   `ST = <STATE>`

   `L = <LOCATION>`

   `O = <YOUR_ORGANISATION>`

   `CN = <IP-ADDRESS>`

   `[v3_req]`

   `keyUsage = keyEncipherment, dataEncipherment`

   `extendedKeyUsage = serverAuth`

   `subjectAltName = @alt_names`

   `[alt_names]`

   `IP.1 = <IP-ADDRESS>`

   `IP.2 = 192.168.10.202`

5. Replace <COUNTRY_CODE>, <STATE>, <LOCATION> and <YOUR_ORGANISATION> with the desired values.
6. Replace both properties <IP-ADDRESS> with the IP address of your device.
7. Create the CSR: `openssl req -new -key certificate-key.pem -out certificate.csr -sha512 -config req.conf`

8. The CSR must be signed by a certificate authority (CA) that your browser trusts. You can either give the CSR to a well-known CA your browser trusts by default or use a custom CA to sign your CSR.

9. If you give the CSR to a well-known CA, you will get back a signed certificate. You can upload the certificate.
10. If you want to sign the CSR with a custom or enterprise CA, proceed as follows.
11. Sign the CSR with a private key of a custom CA: `openssl x509 -req -in certificate.csr -CA <CA_ROOT.PEM> -CAkey <CA_KEY.PEM> -CAcreateserial -out certificate-pub.pem -days 365 -sha512 -extfile req.conf -extensions v3_req`
12. Replace <CA_ROOT.PEM> and <CA_KEY.PEM> with the certificate and private key of the trusted CA.

13. If the CA is not included in the list of trusted CAs in your browser, you have to add the CA to the browser's trusted CA list.

Uploading a custom certificate