> For the complete documentation index, see [llms.txt](https://docs.caf.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.caf.io/caf-api/connect/authentication/certificates/creating-certificate.md).

# Creating a Certificate

To create a certificate for `mTLS` authentication with Certta `APIs`, follow these steps:

## Access Trust

1. **Log in to the Trust portal**:
   * Navigate to the Trust portal and authenticate with your credentials.
2. **Navigate to API Configurations**:
   * From the dashboard, locate the navigation menu.
   * Click on **Settings** (gear icon) in the menu.
   * Select **API Configurations** from the menu.

![API Configurations](/files/0Eyy0GpEkmiSk7AwVVFK)

## Certificate creation process

To create a certificate for `mTLS`, you need to generate a Certificate Signing Request (`CSR`) and have it signed by the Certta certificate authority:

### Uploading your certificate signing request (CSR)

1. **Access certificates section**:

   * On the **API configurations** page, select the **Certificates** tab.
   * This page displays your existing certificates with their status and expiration dates.
   * Click the **+ New certificate** button in the page header.

   ![Certificates List](/files/kiho0kW61n1ODKzMxrqa)
2. **Upload Certificate Signing Request**:

   * A "New certificate" modal will appear with an upload area for your CSR file.
   * You can click on the upload area or drag and drop your CSR file.

   ![New Certificate Modal](/files/MWR79uI2kwOqDUhaeRIy)
3. **Select your CSR file**:

   * After selecting your CSR file, it will appear in the upload area.
   * Click the **Create certificate** button which becomes enabled once a file is uploaded.

   ![CSR File Uploaded](/files/4mWQ4mXdjspxS1DimKjR)
4. **Download your certificate**:

For advanced users who prefer to generate and keep their private key:

1. **Generate a CSR**:

   * Using **OpenSSL** or a similar tool, generate a private key and CSR.
   * Example OpenSSL command:

   ```bash
   openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out certificate.csr
   ```
2. **Upload your CSR**:
   * In the certificate creation dialog, upload your CSR file by either:
     * Dragging and dropping the file into the designated area, or
     * Clicking the upload button to browse and select your CSR file.
   * Click "Create certificate" when ready.
3. **Download your certificate**:

   * When the certificate is successfully generated, you'll see a success modal with a **Download certificate** button.
   * Click the button to download your signed certificate (`.crt` file).
   * Combine this certificate with your private key for use with your applications.

   <div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p><strong>Important</strong>: Make sure to download your certificate before closing the modal.</p></div>

   ![Certificate Generated](/files/QRsVtopgiuPUV5wPOLwf)

{% hint style="warning" %}
**Important**: Keep your private key secure at all times. If it becomes compromised, you should immediately revoke the certificate and request a new one.
{% endhint %}

## Certificate usage

The certificates issued by Certta are used for production API access. These certificates:

* Enable secure mTLS connections to Certta production APIs
* Have a defined validity period
* Must be renewed before expiration to ensure uninterrupted service
* Are subject to verification by the Certta certificate authority

## Next steps

After creating your certificate, you'll need to:

1. [Configure your client to use mTLS](/caf-api/connect/authentication/using-mtls.md)
2. Learn how to [manage your certificates](/caf-api/connect/authentication/certificates/managing-certificate.md) throughout their lifecycle


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.caf.io/caf-api/connect/authentication/certificates/creating-certificate.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.