Obtain SSL/TLS Certificates
- Create Self-Signed Certificate

Obtain SSL/TLS Certificates

You can obtain the SSL/TLS certificate in the following two ways:

Self-signed certificate: It means using a certificate that is issued by yourself. However, self-signed certificates have many security risks and are only recommended for testing and verification environments.
Apply or purchase a certificate: You can apply for a free certificate from Let’s Encrypt (opens new window) or cloud vendors such as Huawei Cloud and Tencent Cloud, or purchase a paid certificate from organizations such as DigiCert (opens new window). For enterprise users, it is generally recommended to apply for paid OV or above certificates to obtain a higher level of security protection.

Create Self-Signed Certificate

Prerequisite

OpenSSL (opens new window) is installed.

Run the following command to generate a key pair. The command will prompt you to enter a password to protect the key, which will be required for generating, issuing, and verifying the certificate. Keep the key and password secure.
```
openssl genrsa -des3 -out rootCA.key 2048
```
Run the following command to generate a CA certificate using the private key from the key pair. The command will prompt you to set the certificate’s Distinguished Name (DN).
```
openssl req -x509 -new -nodes -key rootCA.key -sha256 -days 3650 -out rootCA.crt
```

Use the CA certificate from step 2 to issue a server certificate, which is used to verify the identity of the server owner. The server certificate is usually issued to the hostname, server name, or domain name (such as www.emqx.com (opens new window)). We need to use the CA key (rootCA.key), CA certificate (rootCA.crt), and server CSR (server.csr) to generate the server certificate.

Run the following command to generate a key pair for the server certificate:
```
openssl genrsa -out server.key 2048
```
Run the following command to create a CSR using the server key pair. After the CSR is signed by the CA root certificate private key, a certificate public key file can be generated and issued to the user. This command will also prompt you to set the Distinguished Name (DN) for the certificate.
```
openssl req -new -key server.key -out server.csr
```

The system will prompt the following information, with corresponding meanings explained as below:

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]: # country/region
State or Province Name (full name) [Some-State]: # state/province
Locality Name (eg, city) []: # The city or locality
Organization Name (eg, company) [Internet Widgits Pty Ltd]: # The full name of the organization (or company name), e.g. EMQ
Organizational Unit Name (eg, section) []: # The name of the department or division within the organization，e.g. EMQX
Common Name (e.g. server FQDN or YOUR name) []: # The fully-qualified domain name (FQDN) of the server that will use the certificate, e.g. mqtt.emqx.com
...

Generate the server certificate and specify the validity period of the certificate, which is set to 365 days in this case:
```
openssl x509 -req -in server.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out server.crt -days 365
```

You now have a set of certificates.

.
├── rootCA.crt
├── rootCA.key
├── rootCA.srl
├── server.crt
├── server.csr
└── server.key