> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/create-a-self-signed-certificate.md).

# Create a Self-Signed Certificate

We recommend using a self-signed certificate only for development environments. For production environments, see [Install or Renew a Custom Certificate](/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/install-or-renew-a-custom-certificate.md).

**Create the certificate**

1. In an SSH session to the Cortex XSOAR server, install OpenSSL by running the following command:
   * For Ubuntu: **`sudo apt install openssl`**
   * For Fedora: **`sudo yum install openssl`**
2. Generate the private key and the certificate:

   **`openssl req -newkey rsa:4096 -x509 -sha256 -days 3650 -out example.crt -keyout example.key`**

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>If you prefer to create a key without a passphrase, add the <strong><code>-nodes</code></strong> flag.</p></div>

   | Flag                | Description                                                                                                   |
   | ------------------- | ------------------------------------------------------------------------------------------------------------- |
   | -newkey rsa:4096    | Generates a 4096-bit RSA new private key. The default RSA key is 2048 bits.                                   |
   | -x509               | Creates a X.509 certificate.                                                                                  |
   | -sha256             | Uses 265-bit SHA (Secure Hash Algorithm).                                                                     |
   | -days 3650          | The number of days for which to certify the certificate. 3650 is ten years. You can use any positive integer. |
   | -out example.csr    | Specifies the file name for the newly created certificate signing request. You can specify any file name.     |
   | -keyout example.key | Specifies the file name for the newly created private key. You can specify any file name.                     |

**Apply the Certificate**

1. Stop the Cortex XSOAR server.

   **sudo service demisto stop**

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>In a live backup setup environment, you need to stop both servers and update the certificates on both servers before bringing them back up.</p></div>
2. Replace the existing default internal certificate in `/usr/local/demisto/cert.pem` and key in `/usr/local/demisto/cert.key` with the newly generated private certificate and key.

   For example:

   Copy the certificate (example.crt) to /usr/local/demisto: **`cp example.crt /usr/local/demisto/cert.pem`**

   Copy the key (example.key) to /usr/local/demisto: **`cp example.key /usr/local/demisto/cert.key`**
3. (Optional) Add the certificate to your trusted certificate store.

   For Ubuntu: Copy the certificate (.crt) file to: `/usr/local/share/ca-certificates/` using the command: **`sudo update-ca-certificates`**.

   Ensure that the (.crt) file permissions is: 644

   When running in a distributed database environment, in the application server add the database certificates as trusted.

   In a Red Hat operating system, make sure the certificate was appended in the file `/etc/pki/tls/certs/ca-bundle.crt`
4. Restart the Cortex XSOAR server.

   **sudo service demisto start**


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.14/onboard-cortex-xsoar/single-server-deployment/post-installation-checklist/create-a-self-signed-certificate.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.