# Not secure connection - Certificates

**URL:** <https://forum.inductiveautomation.com/t/not-secure-connection-certificates/57796>\
**Category:** Ignition\
**Tags:** ignition81\
**Created:** [March 30, 2022, 11:33am UTC](https://forum.inductiveautomation.com/t/not-secure-connection-certificates/57796 "2022-03-30T11:33:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mario\_M](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@Mario\_M](https://forum.inductiveautomation.com/u/Mario_M)\
**Post date:** [March 30, 2022, 11:33am UTC](https://forum.inductiveautomation.com/t/not-secure-connection-certificates/57796/1 "2022-03-30T11:33:17Z")

</div>

I have a private network where ignition is installed. For that reason I’m not interested in paying a CA. I’m looking for installing my own certificate but I’m not being able to do it.

On “Networking” \< “Web Server” \< “SSL / TLS” → “I have all the items above”  
I can paste a private key but the server certificate gives me this error: “Server certificate is self-signed”.  
So, is there another way to do it? Any advice?

Thank you!

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [March 30, 2022, 11:56am UTC](https://forum.inductiveautomation.com/t/not-secure-connection-certificates/57796/2 "2022-03-30T11:56:04Z")

</div>

In current versions, there is an advanced property for self-signed certificates.

But consider simply creating your own CA and using it to sign certs in your infrastructure. (A CA is a self-signed cert that is marked to allow signing other certs.) OpenSSL has [documentation](https://www.openssl.org/docs/man3.0/man1/openssl-ca.html) on how to do this.

---

<div class="post-metadata">

**Author:** ![Mario\_M](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@Mario\_M](https://forum.inductiveautomation.com/u/Mario_M)\
**Post date:** [March 30, 2022, 12:13pm UTC](https://forum.inductiveautomation.com/t/not-secure-connection-certificates/57796/3 "2022-03-30T12:13:01Z")

</div>

I can create certs with XCA, but cannot use them on ignition (or maybe not doing it in the right way).

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [March 30, 2022, 1:10pm UTC](https://forum.inductiveautomation.com/t/not-secure-connection-certificates/57796/4 "2022-03-30T13:10:29Z")

</div>

It’s easiest if you either let Ignition generate the self-signed certificate, or if generate a CSR from Ignition and then get it signed by a CA (even if it’s your own internal CA).

---

<div class="post-metadata">

**Author:** ![Mario\_M](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@Mario\_M](https://forum.inductiveautomation.com/u/Mario_M)\
**Post date:** [April 1, 2022, 7:24am UTC](https://forum.inductiveautomation.com/t/not-secure-connection-certificates/57796/5 "2022-04-01T07:24:50Z")

</div>

Finally I did it with my own CA program without paying. I used XCA and it works for my private network.  
You have to create four certificates, but first you need to understand how this works. This helped me out:

> **[Explaining the Chain of Trust - Learn What is it & How it Works](https://www.thesslstore.com/knowledgebase/ssl-support/explaining-the-chain-of-trust/)**
>
> One of the most common questions we field is in relation to the “Chain of Trust.” If you’ve ever had any questions about roots, intermediates or how SSL certificates are chained, you’re discussing the Chain of Trust.

Following this last video you will be able to create:

- Private key
- Server Certificate
- Intermediate CA Certificate
- Root CA Certificate  
[Create Your Own Certificate Authority with XCA - YouTube](https://www.youtube.com/watch?v=1ZJ2DKL_5Cg)  
Then create a .pfx for your computer, save it on your navigator, and you are ready to go!