# Managing keystores for multiple servers (SSL)

**URL:** <https://forum.inductiveautomation.com/t/managing-keystores-for-multiple-servers-ssl/54424>\
**Category:** Ignition\
**Tags:** security\
**Created:** [December 23, 2021, 9:29am UTC](https://forum.inductiveautomation.com/t/managing-keystores-for-multiple-servers-ssl/54424 "2021-12-23T09:29:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![david.wooffindin](https://avatars.discourse-cdn.com/v4/letter/d/f475e1/32.png) [@david.wooffindin](https://forum.inductiveautomation.com/u/david.wooffindin)\
**Post date:** [December 23, 2021, 9:29am UTC](https://forum.inductiveautomation.com/t/managing-keystores-for-multiple-servers-ssl/54424/1 "2021-12-23T09:29:13Z")

</div>

Hello,  
I’m trying to understand what options I have to manage in a more central manner the certificates/ certificate store for HTTPS communication between clients and the gateways.  
Is there a way to configure the gateways to use a specific keystore or server alias ?  
We’re using an AD environment and have our internal CA - i’d like to have a ‘common’ keystore that i distribute to 80 gateways, and this keystore would contain an alias key-pair for each individual gateway - and in the gateway config i would tell each one the alias that it should use.  
Is anything like this even remotely possible ?  
thanks!

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [December 23, 2021, 2:22pm UTC](https://forum.inductiveautomation.com/t/managing-keystores-for-multiple-servers-ssl/54424/2 "2021-12-23T14:22:35Z")

</div>

There are some system properties that may help:

- `ignition.ssl.keystore.alias`
- `ignition.ssl.keystore.password`
- `ignition.ssl.privatekey.password`

These would get set in the “additional params” section of `ignition.conf`.

I don’t see a way to point to a different keystore all together, though, so make sure you use the default `ssl.pfx` in the webserver directory of the Ignition install.

---

<div class="post-metadata">

**Author:** ![david.wooffindin](https://avatars.discourse-cdn.com/v4/letter/d/f475e1/32.png) [@david.wooffindin](https://forum.inductiveautomation.com/u/david.wooffindin)\
**Post date:** [January 3, 2022, 7:19am UTC](https://forum.inductiveautomation.com/t/managing-keystores-for-multiple-servers-ssl/54424/3 "2022-01-03T07:19:03Z")

</div>

> [@Kevin.Herron](#):
>
> There are some system properties that may help:
> 
> - `ignition.ssl.keystore.alias`
> - `ignition.ssl.keystore.password`
> - `ignition.ssl.privatekey.password`
> 
> These would get set in the “additional params” section of `ignition.conf` .
> 
> I don’t see a way to point to a different keystore all together, though, so make sure you use the default `ssl.pfx` in the webserver directory of the Ignition install.

Hi,  
When i go thru the SSL/TLS setup wizard and generate a CSR, i see that both ssl.pfx and csr.pfx are then generated. They don't exist until i do the the SSL configuration wizard.

I was looking to manage these centrally: storing multiple gateway keypairs in the same keystore and distributing a centrally managed ssl.pfx file to our various gateways.  
This obviously means circumventing Ignition's built-in certificate generation features and means I need to manage them separately (KeyStore Explorer for example...).  
I'll let you know if it actually works - any remarks or dissuasive comments are highly welcomed 🙂