# How to install Ignition 8 Self Signed Certificate on Ubuntu 18.04

**URL:** <https://forum.inductiveautomation.com/t/how-to-install-ignition-8-self-signed-certificate-on-ubuntu-18-04/31365>\
**Category:** Ignition\
**Created:** [January 17, 2020, 2:40pm UTC](https://forum.inductiveautomation.com/t/how-to-install-ignition-8-self-signed-certificate-on-ubuntu-18-04/31365 "2020-01-17T14:40:35Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Faisal.Shibli](https://avatars.discourse-cdn.com/v4/letter/f/90db22/32.png) [@Faisal.Shibli](https://forum.inductiveautomation.com/u/Faisal.Shibli)\
**Post date:** [January 17, 2020, 2:40pm UTC](https://forum.inductiveautomation.com/t/how-to-install-ignition-8-self-signed-certificate-on-ubuntu-18-04/31365/1 "2020-01-17T14:40:35Z")

</div>

It is my first time working with SSL certificate. I am in the process of migrating from Ignition 7 to Ignition 8. Ignition 7 did not have SSL enabled while in Ignition 8 we are trying out the SSL. Due to the fact we are testing out so we are using Self signed certificate.

I created the self signed certificate through ignition 8 gateway (Networking → Webserver). My gateway is running on Windows Server 2016. Once the ssl was enabled, I went into the address bar and exported the certificate and saved it under C:\users\username.ignition\clientlauncher-data\certificate. I was able to successfully launch the visionclient launcher. Using the same methodology, I got the visionclient launcher to work from my laptop.

The same methodology did not work on Ubuntu 18.04. I was using chrome to export the certificate however in ubuntu chrome does not even allow me proceed to the website and returns with the following error(please see below).

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/f/f425c46cef374dbb63b8df2e5b3fe8a9a74d438f.jpeg)

I then used firefox and saved the certification’s …/.ignition/…/certificate folder. But when I launch the client launcher and add the gateway URL with 8043 port it says SSL certificate not found. I would really appreciate if you can help me out with this.

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/2X/5/5e545c4993eeb9b4ac5841140d57279973e7d1a5.jpeg)

In a nutshell, I was able to get this to work on Windows based system however, I was unable to get this to work on Ubuntu.

Thanks

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [January 17, 2020, 3:12pm UTC](https://forum.inductiveautomation.com/t/how-to-install-ignition-8-self-signed-certificate-on-ubuntu-18-04/31365/2 "2020-01-17T15:12:45Z")

</div>

Place the certificate in ~~/etc/ssl/certs/~~ /usr/local/share/ca-certificates/ and then run `sudo update-ca-certificates`.

---

<div class="post-metadata">

**Author:** ![Faisal.Shibli](https://avatars.discourse-cdn.com/v4/letter/f/90db22/32.png) [@Faisal.Shibli](https://forum.inductiveautomation.com/u/Faisal.Shibli)\
**Post date:** [January 17, 2020, 3:18pm UTC](https://forum.inductiveautomation.com/t/how-to-install-ignition-8-self-signed-certificate-on-ubuntu-18-04/31365/3 "2020-01-17T15:18:27Z")

</div>

Thank you for the quick response pturmel. I will try it out but just to confirm will this work with self signed certificate. Based on the folder location it appears that its looking for ca certified certificates.

Thanks!

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [January 17, 2020, 3:43pm UTC](https://forum.inductiveautomation.com/t/how-to-install-ignition-8-self-signed-certificate-on-ubuntu-18-04/31365/4 "2020-01-17T15:43:24Z")

</div>

If it doesn’t work, then I would recommend creating a self-signed CA and installing it like so. Then sign your Ignition cert with the private CA.

---

<div class="post-metadata">

**Author:** ![Faisal.Shibli](https://avatars.discourse-cdn.com/v4/letter/f/90db22/32.png) [@Faisal.Shibli](https://forum.inductiveautomation.com/u/Faisal.Shibli)\
**Post date:** [January 17, 2020, 4:05pm UTC](https://forum.inductiveautomation.com/t/how-to-install-ignition-8-self-signed-certificate-on-ubuntu-18-04/31365/5 "2020-01-17T16:05:13Z")

</div>

> [@pturmel](#):
>
> certificates

Hi pturmel,

I tried your way but unforunately, it did not work.

I have been using the self signed certificate that I created via Ignition gateway. We do not have internal CA but I would imagine any windows server can act as a internal CA.

Thank you again for your help.

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [January 17, 2020, 4:32pm UTC](https://forum.inductiveautomation.com/t/how-to-install-ignition-8-self-signed-certificate-on-ubuntu-18-04/31365/6 "2020-01-17T16:32:32Z")

</div>

> [@Faisal.Shibli](#):
>
> We do not have internal CA

OpenSSL can create a self-signed certificate that has the CA flag turned on. Anyone can make a private CA. These two commands will make a password-protected private key and then a CA cert good for ten years:

```auto
openssl genrsa -aes256 -out MyCA.key 4096
openssl req -new -batch \
  -subj "C=US,ST=MyState,L=MyCity,O=MyCompany,OU=IT,CN=CertificateAuthority" \
  -set_serial 1 -x509 -days 3650 -key MyCA.key -out MyCA.crt

```

Use the above CA to make a two-year cert for your server like so:

```auto
openssl genrsa -out SomeIgnitionServer.key 2048
openssl req -new -batch \
  -subj "C=US,ST=MyState,L=MyCity,O=MyCompany,OU=Servers,CN=CertificateAuthority" \
  -key SomeIgnitionServer.key -out SomeIgnitionServer.req
openssl x509 -req -in SomeIgnitionServer.req -out SomeIgnitionServer.crt \
  -outform PEM -set_serial 2 -days 730 -CA MyCA.crt -CAkey MyCA.key

```

Repeat the latter section as needed for new servers, incrementing the serial number each time.

> [@Faisal.Shibli](#):
>
> I would imagine any windows server can act as a internal CA.

Uhm, no. At its core, a CA is a specially-created certificate that can sign other certificates. It's not a server, per se, though publicly-trusted CA holders generally provide a web interface to request signed certs.

---

<div class="post-metadata">

**Author:** ![Faisal.Shibli](https://avatars.discourse-cdn.com/v4/letter/f/90db22/32.png) [@Faisal.Shibli](https://forum.inductiveautomation.com/u/Faisal.Shibli)\
**Post date:** [January 20, 2020, 3:53pm UTC](https://forum.inductiveautomation.com/t/how-to-install-ignition-8-self-signed-certificate-on-ubuntu-18-04/31365/7 "2020-01-20T15:53:25Z")

</div>

> [@pturmel](#):
>
> your

Thank you for the detailed instruction.

Just so I understand correctly, that instead of using the self signed certificate that I created from Ignition gateway, NETWORKING --\> Webserver tab. I will be using openssl to create a self signed certificate.

For "CN" i will use the URL that will get me to the gateway server minus the port number.  
I may have few more questions as I work through your steps.