# Self signed SSL certs and designer

**URL:** <https://forum.inductiveautomation.com/t/self-signed-ssl-certs-and-designer/79227>\
**Category:** Ignition\
**Tags:** ignition81\
**Created:** [September 15, 2023, 4:35pm UTC](https://forum.inductiveautomation.com/t/self-signed-ssl-certs-and-designer/79227 "2023-09-15T16:35:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeff1](https://avatars.discourse-cdn.com/v4/letter/j/4af34b/32.png) [@jeff1](https://forum.inductiveautomation.com/u/jeff1)\
**Post date:** [September 15, 2023, 4:35pm UTC](https://forum.inductiveautomation.com/t/self-signed-ssl-certs-and-designer/79227/1 "2023-09-15T16:35:48Z")

</div>

I am currently using a self signed ca certificate and cannot launch designer from another machine. I get the following error:

> Error launching application:  
> sslhandshakeexception pkix path building failed  
> sun.security.provider.certpath.suncertpathbuilderexception: unable to find valid certification path to requested target

![crt error](https://us1.discourse-cdn.com/inductiveautomation/original/3X/9/2/92b139a59fde3bea55e7dfcaaed4fd1a168bff60.png)

I tried adding the certificate to Java with keytool:

> keytool -importcert -alias Example -keystore "C:\Program Files (x86)\Java\jre1.8.0\_351\lib\security\cacerts" -file "C:\Users\ ***\*** \*\*\*\https\_\_\_10.10.211.180\_8043.crt"

After restarting Java I still have the same error. What do I need to do to trust the certificate? Or am I going about this all wrong? When it moves to production I will purchase a "real" cert for the public IP. Should I allow 8088 connections and block that port at the network level for the WAN?

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [September 15, 2023, 4:43pm UTC](https://forum.inductiveautomation.com/t/self-signed-ssl-certs-and-designer/79227/2 "2023-09-15T16:43:57Z")

</div>

You just need to add it to the right KeyStore.

[https://docs.inductiveautomation.com/display/DOC81/Security+Certificates#SecurityCertificates-AddingSecurityCertificatesintoKeyStores](https://docs.inductiveautomation.com/display/DOC81/Security+Certificates#SecurityCertificates-AddingSecurityCertificatesintoKeyStores)

[https://docs.inductiveautomation.com/display/DOC81/Launcher+Settings#LauncherSettings-AddingSecurityCertificatestoClients](https://docs.inductiveautomation.com/display/DOC81/Launcher+Settings#LauncherSettings-AddingSecurityCertificatestoClients)

Make sure you're adding the root CA cert, not the leaf cert.

---

<div class="post-metadata">

**Author:** ![jeff1](https://avatars.discourse-cdn.com/v4/letter/j/4af34b/32.png) [@jeff1](https://forum.inductiveautomation.com/u/jeff1)\
**Post date:** [September 15, 2023, 5:05pm UTC](https://forum.inductiveautomation.com/t/self-signed-ssl-certs-and-designer/79227/3 "2023-09-15T17:05:39Z")

</div>

That worked. I was missing the cert in

> `{user folder}\.ignition\clientlauncher` `-` `data\certificates`

I looked at that documentation in my troubleshooting and thought that applied to the "Vision Client" while I was going to battle with the Designer. Thank you.

---

<div class="post-metadata">

**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\
**Post date:** [September 15, 2023, 5:44pm UTC](https://forum.inductiveautomation.com/t/self-signed-ssl-certs-and-designer/79227/4 "2023-09-15T17:44:09Z")

</div>

Also just to add some implementation details, these "supplemental certificate" locations are just places we look for certificates to import into the main `cacerts` KeyStore, so you could still use that mechanism directly. You just need to be targeting the one from the embedded runtimes, not some leftover Java 8 install on your system. The benefit of using the supplemental folder, though, is that when we upgrade the runtimes they'll get imported again and continue to work.