# SSL certificates

> Replace the Cloud Management Platform (CMP) appliance's self-signed certificate with one your clients trust, so browsers can verify the connection

---

Site [llms.txt](/llms.txt)

---

To log in to the CMP appliance for the first time, you must accept the self-signed certificate. To let your browser verify the certificate afterward, configure CMP with a certificate trusted by your clients.

CMP requires a certificate issued by either a public or a private CA. Ensure all your client and user devices trust this CA.

<div class="alert alert-info" role="alert">


**Additional resource:** [How to force HSTS in CloudBolt Server](https://support.cloudbolt.io/cloudbolt/s/article/how-to-force-hsts-in-cloudbolt-server--1622409219--1)
</div>


## Install a signed certificate

If you already have a signed certificate and key in PEM (Base64-encoded) format, update the certificate on the CMP appliance via SSH/SCP. Otherwise, first [generate a CSR](#generate-a-csr).

1. Copy your PEM-formatted SSL *cert* to `/etc/pki/tls/certs/localhost.crt`.
1. Copy your PEM-formatted SSL *key* to `/etc/pki/tls/private/localhost.key`.
1. Set the file permissions:

   ```text
   chmod 400 /etc/pki/tls/certs/localhost.crt /etc/pki/tls/private/localhost.key
   ```

1. Restart CMP: `service httpd restart`.

## Generate a CSR

If you do not have a certificate, create a CSR to be signed by your certificate authority, using the following steps on the CMP appliance via SSH.

1. Create an OpenSSL configuration file (for example, *req.conf*) and fill out the details for your CSR:

   ```text
   [req]
   distinguished_name = req_distinguished_name
   req_extensions = v3_req
   prompt = no
   [req_distinguished_name]
   C = US
   ST = VA
   L = City
   O = YourOrganization
   OU = YourOrganizationUnit
   CN = cloudbolt.example.com
   [v3_req]
   keyUsage = keyEncipherment, dataEncipherment
   extendedKeyUsage = serverAuth
   subjectAltName = @alt_names
   [alt_names]
   DNS.1 = cloudbolt.example.com
   ```

1. Update the hostname for your CMP instance in both places (for maximum client compatibility): `CN =` and `DNS.1 =`.
1. Add hostnames at the end of the file if you need additional branded portals:

   ```text
   DNS.3 = portal2.example.net
   ```

1. Run the following command to create the CSR and a new key from the configuration file:

   ```text
   openssl req -new -out cloudbolt.csr -newkey rsa:2048 -nodes -sha256 -keyout new_localhost.key -config req.conf
   ```

1. Submit `cloudbolt.csr` to your chosen certificate authority.
1. This command also generates `new_localhost.key`, which does not need to be shared with the certificate authority. Use it when you receive the certificate file from your CA, then see [Install a signed certificate](#install-a-signed-certificate) for installation instructions.