# Creating Self-Signed Certificates in Key Manager Plus

Key Manager Plus allows administrators to create their own [self-signed certificates](https://www.manageengine.com/key-manager/self-signed-ssl-certificates.html) using Java keytool. These certificates are automatically imported into the Key Manager Plus repository on successful creation.

**To create a self-signed certificate using Key Manager Plus:**

1. Navigate to the **SSL >> Certificate** tab and click **Create** in the top pane.

   ![ssl-create-certificate](https://cdn.manageengine.com/sites/meweb/images/key-manager/help/ssl-create-certificate.png)

2. In the **Create Certificate** form, enter a name (domain name) for the certificate in the **Common Name** field, and provide the required organizational and certificate-specific details:

   1. **Organization Information** - Enter the organization unit, organization name, location, state, country, and email address.

   2. **Key Configuration** - Select either **Classic** or **Post-Quantum** as the **Cryptography**.

      **Note:** Post-Quantum Cryptography is available from build 7220 and above only.

      1. If you have selected **Classic** cryptography, select **Key Algorithm**, **Key Size**, **Signature Algorithm**, and **KeyStore Type** from the respective drop-down fields.

      2. If you have selected **Post-Quantum** cryptography, select the **Key Algorithm** from the dropdown. By default, the **KeyStore Type** will be **PKCS12** and it cannot be changed. Refer to [this](https://www.manageengine.com/key-manager/help/manage-ssl-certificates.html#pqc) help document for complete details on the supported key algorithms of the post-quantum cryptography.

   3. **Certificate Validity** - Choose **Validity Type** as **Days**, **Hours**, or **Minutes** depending on your requirement. Enter the validity duration in the next field. For short-term testing or temporary use, you can create ephemeral certificates with validity in hours or minutes.

3. Provide a **Store Password** to protect the certificate.

4. Enter an email address to receive alerts before the certificate expires, helping you ensure timely renewal.

5. To designate the certificate as a root certificate, enable the **Generate root certificate** checkbox.

6. Click **Advanced Options** to specify additional key usage attributes, if required. Here, there are two categories of options, **Key Usage** and **Extended Key Usage**. Select the required options to set the preferred flags for the certificate to denote the purpose for which the new certificate may be used. The **Key Usage** options include Non Repudiation, Digital Signature, Data or Key Encipherment, Server/Client Authentication etc. You can choose the properties and mark them as critical by selecting the **Critical** checkbox.

   ![ssl-create-certificate2](https://cdn.manageengine.com/sites/meweb/images/key-manager/help/ssl-create-certificate2.png)

7. Click the **Create** button. You will be redirected to the certificate window where the certificate content is displayed.

8. You can copy the certificate content, or export the certificate to required email or system.

   1. **Email —** Select this check box to send the certificate file via email to the specified mail id.

   2. **Export —** Select this check box to export the file to your system.

9. Both the options take effect once you click the **Save** button.

10. Click the **Save** button to save the certificate in the Key Manager Plus repository, and export the certificate file, if opted in earlier step.

**Notes:**

1. From Key Manager Plus build 5920 onwards, users can include a wildcard domain in the **SAN** field, in addition to having it in the **Common Name** field, when creating a self-signed certificate. Wildcard certificates allow securing an unlimited number of subdomains under a registered base domain. For example, for the base domain **zoho.com**, a wildcard certificate **\*.zoho.com** can secure any subdomain such as **mail.zoho.com**, **accounts.zoho.com**, or **support.zoho.com**, where the asterisk (*) represents any valid subdomain.

2. From build 7070 onwards, users can specify multiple DNS names in the **SAN** field in a comma-separated format when creating certificates.