# How to import an existing signed SSL cert into Ignition **URL:** \ **Category:** Ignition\ **Created:** [May 12, 2015, 8:12pm UTC](https://forum.inductiveautomation.com/t/how-to-import-an-existing-signed-ssl-cert-into-ignition/10008 "2015-05-12T20:12:30Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![fledder](https://avatars.discourse-cdn.com/v4/letter/f/e19b73/32.png) [@fledder](https://forum.inductiveautomation.com/u/fledder)\ **Post date:** [May 12, 2015, 8:12pm UTC](https://forum.inductiveautomation.com/t/how-to-import-an-existing-signed-ssl-cert-into-ignition/10008/1 "2015-05-12T20:12:30Z")
This is something I spend a bit of time on, so I figured I’d write up a how-to. At least now the next time I forget how to do this, I will be able to find the breadcrumbs… [xkcd.com/979/](https://xkcd.com/979/) I have a UCC SSL cert that I bought for other functions, and added a SAN (basically, another name for the cert to cover) for [demo.mydomain.com](http://demo.mydomain.com). I used my Apache web server to create the CSR, as it is the primary site that I wish to secure; however, now that I have the signed cert, I want to use it to cover my Ignition demo server as well. This is how I got it to work: 1. Collect the files you’ll need. I have a private key file that was generated by OpenSSL called primaryhost.mydomain.com.key, a cert chain file from GoDaddy (where I bought my cert) called gd\_bundle-g2-g1.crt, and a signed certificate file called 65f135a6546c423e.crt (name changed to protect the mostly innocent, but a 16-char hex filename). These may be different if you bought your cert somewhere else. 2. Install the required software. You will need the JDK ( [indy.fulgan.com/SSL/](http://indy.fulgan.com/SSL/) ). I like to add the locations of the binaries to my PATH variable, so I can invoke them from wherever. It’s wise to do the following somewhere besides your Ignition directory, so that when you screw something up, you can start over with minimal crying. The following steps are done in a cmd prompt in the location of your key files. 3. Create a PKCS12 keystore containing your private key, certificate, and key chain. Using OpenSSL: ```auto openssl pkcs12 -export -in 65f135a6546c423e.crt -inkey primaryhost.mydomain.com.key -certfile gd_bundle-g2-g1.crt -out mycerts.pfx -name "tomcat" ``` Enter ignition as the password. 1. Create a new Java keystore to hold the to-be-imported keys. ```auto keytool -genkey -alias tomcat -keystore ssl.key ``` Password is ignition Answer the questions; “first and last name” should match the FQDN for the server (i.e. [demo.mydomain.com](http://demo.mydomain.com)) 1. Empty the new keystore to make room for the imported keys ```auto keytool -delete -alias tomcat -keystore ssl.key ``` 1. Import the keys. ```auto keytool -v -alias tomcat -importkeystore -srckeystore mycerts.pfx -srcstoretype PKCS12 -destkeystore ssl.key -deststoretype JKS -destalias tomcat ``` Provide the passwords ( ignition ) when prompted. 1. Check the keys. ```auto keytool -list -v -keystore ssl.key -alias tomcat ``` You should see a listing of several keys; my key had a cert chain length of 4, meaning that I had listings for Certificate[1] through Certificate[4]. Yours might be different, but verify that the alias is tomcat and the certificates say something about your certificate and your cert issuer. In my case, I also verified that I have a listing for `SubjectAlternativeName [ DNSName: demo.mydomain.com ]` 1. Move this new keystore into the Ignition directory (mine is c:\program files\inductive automation\ignition\webserver). [size=150]Make sure you have a backup copy of the original ssl.key before you do this.[/size] Restart the gateway from the gateway control utility. Presto! You have a properly-secured gateway on a subject alternative name. This could also be useful for a wildcard cert, if you’re fancy enough to have one of those. The key issue I was having earlier was getting that alias “tomcat” into the PKCS12 file, as keytool won’t create an alias unless one already exists. I found this ( [sslshopper.com/article-most … jn554906de](https://www.sslshopper.com/article-most-common-openssl-commands.html?jn554906de) , along with the Ignition manual entry on certificates. Please let me know if you find any errors, and I will correct them. ---
**Author:** ![salbrechtsen](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/salbrechtsen/32/18660_2.png) [@salbrechtsen](https://forum.inductiveautomation.com/u/salbrechtsen)\ **Post date:** [July 12, 2018, 5:39pm UTC](https://forum.inductiveautomation.com/t/how-to-import-an-existing-signed-ssl-cert-into-ignition/10008/2 "2018-07-12T17:39:33Z")
Sill relevant in 2018. Worked like a charm with our GoDaddy Wildcard Cert. Thanks for the quality post! ---
**Author:** ![c-w-t](https://avatars.discourse-cdn.com/v4/letter/c/bbe5ce/32.png) [@c-w-t](https://forum.inductiveautomation.com/u/c-w-t)\ **Post date:** [January 20, 2019, 1:06am UTC](https://forum.inductiveautomation.com/t/how-to-import-an-existing-signed-ssl-cert-into-ignition/10008/3 "2019-01-20T01:06:38Z")
This was a savior for me, I managed to get this done with some old notes last year, but this year I was running into trouble. Thanks!! ---
**Author:** ![NorthPoint](https://avatars.discourse-cdn.com/v4/letter/n/a88e4f/32.png) [@NorthPoint](https://forum.inductiveautomation.com/u/NorthPoint)\ **Post date:** [March 14, 2019, 5:36pm UTC](https://forum.inductiveautomation.com/t/how-to-import-an-existing-signed-ssl-cert-into-ignition/10008/4 "2019-03-14T17:36:31Z")
Excellent info here on how to use keytool more flexibly. ---
**Author:** ![Caleb\_Bohon](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/caleb_bohon/32/3293_2.png) [@Caleb\_Bohon](https://forum.inductiveautomation.com/u/Caleb_Bohon)\ **Post date:** [July 30, 2020, 2:32pm UTC](https://forum.inductiveautomation.com/t/how-to-import-an-existing-signed-ssl-cert-into-ignition/10008/5 "2020-07-30T14:32:24Z")
Here is some info for using a wildcard cert... > [@Wildcard SSL from Ignition 8](http://forum.inductiveautomation.com/t/wildcard-ssl-from-ignition-8/36954): > > I am attempting to generate a Wildcard SSL with an Ignition 8 Gateway and reuse the SSL key on other Gateways. Right now I have the cert generated and installed, but I am not sure what to move to other gateways. With 7.9 we were able to move just the ssl.key file, but that file does not exist on Ignition 8. After generating a cert with Ignition 8 is there a method that I can use to move or import that same cert to other Ignition 8 GWs? Can I do the same thing with Ignition 7.9? If the a…