Use spaces, commas, or semicolons to separate multiple hostnames.DNS Name: Specify any of the servers fully qualified domain names (.Subject Alternative Name: Beginning around 2017, browsers have required that the servers fully qualified domain name appears in the Subject Alternative Name (SAN) extension.

Organization: Review local policy or existing certificates, usually a business/corporation name.

Common Name: Specify the servers fully qualified domain name (.

To create an ECDSA key instead of RSA, specify 'sha512WithECDSA'.

Signature Algorithm: Unless local policy suggests otherwise, select 'sha512WithRSA'.

Using larger keys can cause additional CPU on busy servers. Review local security policies or select 2048.

Key Size: The Key Size should be increased past 1024 to not risk being rejected by browsers.

Key Label: The name you want to give the certificate to identify it in iKeyman Consider specifying the DNS domain name and optionally a month or year of creation.

Do not skip any of the below fields or it is likely that browsers will not accept your certificate without warnings:

You will be presented with the following panel, see the bullets in the following section for recommendationsĬarefully read the guidance on each field below.

From the Personal Certificate Requests section, click New.

Click the 'down arrow' to the right, to display a list of three choices.

In the middle of the iKeyman GUI you will see a section called Key database content.

The certificate is ready to use immediately. After creating the self-signed certificate, skip to the final step in this document.The certificate is created in a single step. There will be no input for an output file name.Click 'New self-signed' on the bottom right of the screen and skip to specifying the certificate details.If you are using these instructions to create a self-signed certificate:.Open the key database file (.kdb) using the iKeyman utility.

How to open .key file