# Unable to install SSL Certificate **URL:** \ **Category:** Ignition\ **Created:** [August 22, 2020, 6:27pm UTC](https://forum.inductiveautomation.com/t/unable-to-install-ssl-certificate/37998 "2020-08-22T18:27:04Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![rpopeszku](https://avatars.discourse-cdn.com/v4/letter/r/f08c70/32.png) [@rpopeszku](https://forum.inductiveautomation.com/u/rpopeszku)\ **Post date:** [August 22, 2020, 6:27pm UTC](https://forum.inductiveautomation.com/t/unable-to-install-ssl-certificate/37998/1 "2020-08-22T18:27:04Z")
I am unable to complete the SSL certificate installation. The Wizard gives me an error when I try to enter the server certificate. The error message is “Unable to decode next certificate chain” this happens when I drag drop the csr file. I even tried to manually enter the data but get the same error either way. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/d/2d28072cb4f466712eccdb130b8a786c22419825.png) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [August 22, 2020, 7:38pm UTC](https://forum.inductiveautomation.com/t/unable-to-install-ssl-certificate/37998/2 "2020-08-22T19:38:59Z")
You can’t use a certificate request. That would go to your CA. You need a certificate from your CA, not a certificate request. ---
**Author:** ![rpopeszku](https://avatars.discourse-cdn.com/v4/letter/r/f08c70/32.png) [@rpopeszku](https://forum.inductiveautomation.com/u/rpopeszku)\ **Post date:** [August 22, 2020, 8:11pm UTC](https://forum.inductiveautomation.com/t/unable-to-install-ssl-certificate/37998/3 "2020-08-22T20:11:15Z")
Oh, ok. I am not to familiar with the process of getting a certificate. Who is the CA? ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [August 23, 2020, 12:31am UTC](https://forum.inductiveautomation.com/t/unable-to-install-ssl-certificate/37998/4 "2020-08-23T00:31:00Z")
CA == “Certificate Authority”. The organizations that are trusted by browser makers and OS makers to sign certificates that identify people or servers or businesses. For the most serious kind, you pay. For such I use [SSL.com](http://SSL.com), though I used to use DigiCert. It is possible to get certificates for free from [letsencrypt.org](http://letsencrypt.org), though you have specific requirements you must follow to prove you are entitled to have them. It is also possible to be your own CA, but you’ll have to manually tell all your clients to trust it. The overall process goes like this: 1. You generate a private key that you intend to install in your server. Nobody else gets that. 2. You generate a certificate signing request that supplies the name of your organization and the intended name of your server ([www.example.com](http://www.example.com), or whatever), along with cryptographic proof that the file was prepared with your private key. 3. You arrange for a CA to examine your CSR and satisfy themselves that it is appropriate (letsencrypt automates the process) and they countersign the CSR to produce a certificate. 4. You install both private key and cert into your server. 5. From then on, when a client connects via https or other secure channel, your server presents the certificate to the client along with cryptographic proof that it has the private key, during the encryption handshake. The client examines the certificate to validate the signature’s proof of origin in a trusted organization (the CA). ---
**Author:** ![rpopeszku](https://avatars.discourse-cdn.com/v4/letter/r/f08c70/32.png) [@rpopeszku](https://forum.inductiveautomation.com/u/rpopeszku)\ **Post date:** [August 24, 2020, 10:08pm UTC](https://forum.inductiveautomation.com/t/unable-to-install-ssl-certificate/37998/5 "2020-08-24T22:08:06Z")
> [@pturmel](#): > > DigiCert Thanks for the great explanation! Just a few questions so I am clear. 1. What tool do I use to create the private certificate? 2. I assume I use the Ignition "Generate Certificate Signing Request" tool to create the request? 3. Then I can go to either [SSL.com](http://SSL.com) or (other pay service) or [letsencript.org](http://letsencript.org) with the certificate request to get the certificate. Correct? 4. And then finally, what tool do I use to install the certificate onto the server? Oh, and last question. Am I considered a webserver even though I am running the gateway on my home computer? If so where does the [www.example.com](http://www.example.com) name come from? All I have is my public IP address. Is there a way for me to alias that? ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [August 25, 2020, 12:55am UTC](https://forum.inductiveautomation.com/t/unable-to-install-ssl-certificate/37998/6 "2020-08-25T00:55:36Z")
1. “private certificate” is not a meaningful phrase. I create private _ **keys** _ with OpenSSL on a linux command line. There are other tools to do so. I haven’t played with Ignition’s new SSL interface, but it seems like it might have created a key for you as part of creating a CSR. 2. Yup. Some CAs want you to do both private key generation and CSR generation on their website. I don’t particularly like that. CSR’s can also be generated by a variety of tools–I tend to use OpenSSL on a linux command line. 3. Paid services handle the CSR through their website, usually with some form of manual verification of your identity and your right to use the domain name. LetsEncrypt _ **only** _ issues certificates through their automated processes. I do that via a linux command line (certbot) and custom Apache configuration. You’ll have to research the best method for your circumstances if you want a free certificate. Note that the most common automated process for LetsEncrypt involves making your domain name publicly visible on HTTP (not HTTPS), at least for their challenge-response process. 4. The SSL wizard in Ignition looks pretty nice. Paste your cert where you were trying to paste your CSR. 5. Look at Dynamic DNS services to associate a domain name with your public IP address. ---
**Author:** ![r.popeszku](https://avatars.discourse-cdn.com/v4/letter/r/51bf81/32.png) [@r.popeszku](https://forum.inductiveautomation.com/u/r.popeszku)\ **Post date:** [August 25, 2020, 11:46am UTC](https://forum.inductiveautomation.com/t/unable-to-install-ssl-certificate/37998/7 "2020-08-25T11:46:08Z")
Thanks for the help and clarification 👍