Create keys and certificates

  • Release version: Australia
  • Updated March 12, 2026
  • 3 minutes to read

    • Create keys and certificates in your root directory to enable Transport Layer Security (TLS) setup. TLS setup is required before you can configure mTLS on the MID Web Server and agent.

    Before you begin

    • Ensure that there are no keys installed in the MID unified keystore by running the following command:
      bin/scripts/manage-certificates.(sh/bat) -l

      When there are no keys installed, the output is: defaultsecuritypairhandle

    • Invalidate your MID Server.

      If additional keys exist in the output, reinstall those keys after invalidating the MID Server.

    • Ensure that the MID Server is connected to the instance.
    • Select a directory in which you want to create certificates, to be called the root directory.
    • For Windows environments only: Install Win32/Win64 OpenSSL with all dependencies and ensure it is on the system PATH.
    Note:
    This procedure includes commands for both CentOS 7/Linux and Windows Server environments. Select the commands relevant for your host operating system. If working with another Linux distribution, adapt the commands as needed for your specific OS.

    Role required: agent_client_collector_admin

    Procedure

    1. In a Linux environment:
      1. Create subdirectories for your certificates in your root directory. 
        mkdir -p labca labmid labacc;
      2. Generate the EC key pair. 
        openssl ecparam -list_curves;
openssl ecparam -out labca/ec-labcakey.pem -name prime256v1 -genkey; 
ls labca/;

        The generated output is the ec-labcakey.pem file.

      3. Create the root CA certificate. 
        openssl ecparam -in labca/ec-labcakey.pem -text -noout; 
openssl req -x509 -new -nodes -key labca/ec-labcakey.pem -sha512 -days 365 -out labca/labcacert.pem -subj "/C=<country>/ST=<state>/L=<location>/O=<organization> Lab/OU=<organization unit>/CN=<cn abbreviation>"; 
openssl verify labca/labcacert.pem;

        Generated output:

        • labca/labcacert.pem: C = <country>, ST = <state>, L = <location>, O = <organization> Lab, OU = <organization unit>, CN = <cn abbreviation>
        • OK
      4. Import the CA certificate into the system trust store. 
        sudo cp -a labca/labcacert.pem /etc/pki/ca-trust/source/anchors/;
sudo update-ca-trust extract;
openssl verify labca/labcacert.pem

        Generated output: labca/labcacert.pem: OK

      5. Obtain the fully qualified domain name (FQDN) for the host. 
        hostname --all-fqdns;
      6. Generate the server certificate signing request (CSR) and sign it with the CA.

        Enter the FQDN as the <hostname> value in the following commands. If more than one FQDN value is returned, use the value with the following format: hostname.domain.domain.com.

        openssl req -new -newkey rsa:4096 -keyout labmid/rsa-labmidkey.pem -sha512 -nodes -out labmid/mid.csr -subj "/C=<country>/ST=<state>/L=<location>/O=<organization>/OU=<organization unit>/CN=<hostname>";
openssl x509 -req -days 365 -in labmid/mid.csr -CA labca/labcacert.pem -CAkey labca/ec-labcakey.pem -CAcreateserial -extensions SAN -extfile <(cat /etc/pki/tls/openssl.cnf <(printf "\n[SAN]\nsubjectAltName=DNS:<hostname>")) -out labmid/mid.crt;

        Generated output:

        Signature ok
subject=/C=<country>/ST=<state>/L=<location>/O=<organization>/OU=<organization unit>/CN=<mid server host fqdn>
Getting CA Private Key
      7. Combine the key and certificate files into one file, named mid.pem. 
        cat labmid/rsa-labmidkey.pem labmid/mid.crt > labmid/mid.pem;
    2. In a Windows environment:
      1. Create subdirectories for your certificates in your root directory. 
        mkdir labca labmid labacc
      2. Generate the EC key pair. 
        openssl ecparam -list_curves
openssl ecparam -out labca\ec-labcakey.pem -name prime256v1 -genkey
dir labca

        The generated output is the ec-labcakey.pem file.

      3. Create the root CA certificate. 
        openssl ecparam -in labca\ec-labcakey.pem -text -noout
openssl req -x509 -new -nodes -key labca\ec-labcakey.pem -sha512 -days 365 -out labca\labcacert.pem -subj "/C=<country>/ST=<state>/L=<location>/O=<organization> Lab/OU=<organization unit>/CN=<cn abbreviation>"
openssl verify labca\labcacert.pem

        Generated output: C=<country>, ST=<state>, L=<location>, O=<organization> Lab, OU=<organization unit>, CN=<cn abbreviation>

      4. Import the CA certificate into the system trust store. 
        certutil -addstore -f "Root" labca\labcacert.pem
openssl verify -CAfile labca\labcacert.pem labca\labcacert.pem

        Generated output: labca/labcacert.pem: OK

      5. Obtain the fully qualified domain name (FQDN) for the host. 
        net config workstation | findstr /C:<Full Computer name>

        The Full Computer name value returned is the FQDN to use as the <hostname> later in this procedure.

      6. Create the SAN (Subject Alternative Name) configuration file. 
        copy "%ProgramFiles%\OpenSSL-Win64\bin\cnf\openssl.cnf" openssl-san.cnf
echo.>>openssl-san.cnf
echo [SAN]>>openssl-san.cnf
echo subjectAltName=DNS:<hostname>>>openssl-san.cnf

        Adjust the source openssl.cnf path to match your OpenSSL installation location if it differs from the default.

      7. Generate the server certificate signing request (CSR) and sign it with the CA.

        Enter the FQDN as the <hostname> value in the following commands. If more than one FQDN value is returned, use the value with the following format: hostname.domain.domain.com.

        openssl req -new -newkey rsa:4096 -keyout labmid\rsa-labmidkey.pem -sha512 -nodes -out labmid\mid.csr -subj "/C=<country>/ST=<state>/L=<location>/O=<organization>/OU=<organization unit>/CN=<hostname>"
openssl x509 -req -days 365 -in labmid\mid.csr -CA labca\labcacert.pem -CAkey labca\ec-labcakey.pem -CAcreateserial -extensions SAN -extfile openssl-san.cnf -out labmid\mid.crt

        Generated output:

        Signature ok
subject=/C=<country>/ST=<state>/L=<location>/O=<organization>/OU=<organization unit>/CN=<mid server host fqdn>
Getting CA Private Key
        Note:
        With OpenSSL 3.x (the Win32/Win64 installer), the Getting CA Private Key line may not appear in the output, but Signature ok and the correct subject= line are still present. To confirm the certificate was signed correctly, verify labmid\mid.crt directly: 
        openssl x509 -in labmid\mid.crt -noout -subject -dates
        This command shows the subject you specified and valid notBefore/notAfter dates.
      8. Combine the key and certificate files into one file, named mid.pem. 
        copy /b labmid\rsa-labmidkey.pem+labmid\mid.crt labmid\mid.pem

    What to do next

    Set up the MID Web Server with a .pem file.