# Server certificate is self-signed

**URL:** <https://forum.inductiveautomation.com/t/server-certificate-is-self-signed/42420>\
**Category:** Ignition\
**Created:** [January 19, 2021, 10:48pm UTC](https://forum.inductiveautomation.com/t/server-certificate-is-self-signed/42420 "2021-01-19T22:48:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gbclark](https://avatars.discourse-cdn.com/v4/letter/g/b487fb/32.png) [@gbclark](https://forum.inductiveautomation.com/u/gbclark)\
**Post date:** [January 19, 2021, 10:48pm UTC](https://forum.inductiveautomation.com/t/server-certificate-is-self-signed/42420/1 "2021-01-19T22:48:31Z")

</div>

Ignition 8.1 enabling web server SSL.

I have created a self-signed certificate using the New-SelfSignedCertifcate function in PowerShell. I can import the Private Key but when I import the Server Certificate I get an error “Server certificate is self-signed”.

Can we not use self-signed certificates in 8.1?

---

<div class="post-metadata">

**Author:** ![jspecht](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jspecht/32/6465_2.png) [@jspecht](https://forum.inductiveautomation.com/u/jspecht)\
**Post date:** [January 20, 2021, 1:51am UTC](https://forum.inductiveautomation.com/t/server-certificate-is-self-signed/42420/2 "2021-01-20T01:51:32Z")

</div>

You _can_ install self-signed certificates in 8.1. The easiest way to do this is to let Ignition generate one for you. Assuming you have not yet installed a certificate, go to the Gateway Web Interface \> Config \> Networking \> Web Server page, click the “Setup SSL / TLS” button, click the “I don’t have all the items above” button, fill out the required fields in the form, then at the bottom of the form, click the “Show advanced properties” checkbox to reveal the “Install Self Signed Certificate” button, which you can click to generate a self-signed certificate based on the form you just filled out.

 ![Screen Shot 2021-01-19 at 5.43.12 PM](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/0/b07a6dda549d18f810ddd5195d4ff2214d830b9d.png)

If you’d rather use your own self-signed certificate generated outside of Ignition, you’ll need to create a PKCS12 key store file named `ssl.pfx`, and add an entry with your private key and self-signed certificate, the move this key store file to `$IGNITION/data/webserver/ssl.pfx` (where `$IGNITION` is the installation directory of your Gateway).

Ignition assumes the key store entry’s alias, key store password, and private key password are all “ignition”. If this is not the case, you must set system properties `ignition.ssl.keystore.alias`, `ignition.ssl.keystore.password`, and/or `ignition.ssl.privatekey.password` respectively in your `ignition.conf` wrapper file with the overridden values.

---

<div class="post-metadata">

**Author:** ![levi.transtrum](https://avatars.discourse-cdn.com/v4/letter/l/ce7236/32.png) [@levi.transtrum](https://forum.inductiveautomation.com/u/levi.transtrum)\
**Post date:** [October 7, 2025, 5:04pm UTC](https://forum.inductiveautomation.com/t/server-certificate-is-self-signed/42420/4 "2025-10-07T17:04:22Z")

</div>

Note: the target directory has possibly changed since Joel’s answer. On Ignition 8.1.45, I had to place the key store file in `$IGNITION/webserver`, not `$IGNITION/data/webserver`.