Creating Self-Signed Certificates in Key Manager Plus

Key Manager Plus allows administrators to create their own self-signed certificates using Java keytool. These certificates are automatically imported into the Key Manager Plus repository on successful creation.

To create a self-signed certificate using Key manager plus:

1. Navigate to the SSL >> Certificate tab and click Create in the top pane.
   
2. In the Create Certificate form, enter a name (domain name) for the certificate in the Common Name field, and provide the required organizational and certificate-specific details:
   1. Organization Information - Enter the organization unit, organization name, location, state, country, and email address.
   2. Key Configuration - Select either Classic or Post-Quantum as the Cryptography.

      Note: Post-Quantum Cryptography is available from build 7220 and above only.

      1. If you have selected Classic cryptography, select Key Algorithm, Key Size, Signature Algorithm, and KeyStore Type from the respective drop-down fields.
      2. If you have selected Post-Quantum cryptography, select the Key Algorithm from the dropdown. By default, the KeyStore Type will be PKCS12 and it cannot be changed. Refer to this help document for complete details on the supported key algorithms of the post-quantum cryptography.
   3. Certificate Validity - Choose Validity Type as Days, Hours, or Minutes depending on your requirement. Enter the validity duration in the next field. For short-term testing or temporary use, you can create ephemeral certificates with validity in hours or minutes.
3. Provide a Store Password to protect the certificate.
4. Enter an email address to receive alerts before the certificate expires, helping you ensure timely renewal.
5. To designate the certificate as a root certificate, enable the Generate root certificate checkbox.
6. Click Advanced Options to specify additional key usage attributes, if required. Here, there are two categories of options, Key Usage and Extended Key Usage. Select the required options to set the preferred flags for the certificate to denote the purpose for which the new certificate may be used. The Key Usage options include Non Repudiation, Digital Signature, Data or Key Encipherment, Server/Client Authentication etc. You can choose the properties and mark them as critical by selecting the Critical checkbox.
   
7. Click the Create button. You will be redirected to the certificate window where the certificate content is displayed.
8. You can copy the certificate content, or export the certificate to required email or system.
   1. Email — Select this check box to send the certificate file via email to the specified mail id.
   2. Export — Select this check box to export the file to your system.
9. Both the options take effect once you click the Save button.
10. Click the Save button to save the certificate in the Key Manager Plus repository, and export the certificate file, if opted in earlier step.