> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Controller Certificate Management

> Replace the Aviatrix Controller's default self-signed certificate with a signed certificate from a trusted Certificate Authority (CA), either by generating a Certificate Signing Request (CSR) or by uploading a certificate with its private key. You can also change the certificate domain used by the Controller and its gateways.

## Overview

The Aviatrix Controller uses a self-signed certificate by default, which causes
browsers to display the Controller UI as **Not Secure**. To remove the warning
and strengthen the security of the Controller, replace the default certificate
with one issued by a trusted Certificate Authority (CA).

You have two methods to install a signed certificate:

* **Generate a Certificate Signing Request (CSR) and upload the signed
  certificate.** This is the preferred method because the private key never
  leaves the Controller.
* **Upload a certificate with its private key.** Use this method when you must
  generate the key pair outside the Controller.

You can also change the certificate domain used by the Controller and its
gateways.

> [!NOTE]
>
> All certificates and keys must be in PEM format. File names must not contain
> spaces or special characters.

## Prerequisites

* Administrator access to CoPilot.
* A trusted Certificate Authority that can issue a signed certificate for the
  Controller's Fully Qualified Domain Name (FQDN).
* For the key-upload method, a workstation with `openssl` installed.

## Generate a Certificate Signing Request and Upload the Certificate

Use this method to let the Controller generate the private key and CSR. You then
submit the CSR to your CA and upload the signed certificate back to the
Controller.

**1. Open the Controller Certificate card**

1. In CoPilot, go to **Settings > Configuration > General**.
2. Locate the **Controller Certificate** card.
3. Click **Upload Certificate**.
4. Select **Generate Certificate Signing Request and Upload Certificate**.

**2. Generate the CSR**

Under **Step 1: Generate Request**:

1. In **Fully Qualified Domain Name**, enter the Controller's FQDN.
2. Click **Download Request** to generate and download the CSR file to
   your local system.

**3. Obtain the signed certificates**

Submit the CSR to your trusted Certificate Authority. Wait for the CA to
return a signed **CA Certificate** and **Server Public Certificate** in PEM
format.

**4. Upload the signed certificates**

1. Return to **Settings > Configuration > General** and open the
   **Controller Certificate** card.
2. Click **Upload Certificate**.
3. Select **Generate Certificate Signing Request and Upload Certificate**.
4. Under **Step 2: Upload Certificate**, click **Select** next to
   **CA Certificate** and choose the CA certificate file. Repeat for
   **Server Public Certificate**.
5. Click **Upload**.

## Upload a Certificate with a Key

Use this method when you must generate the private key and CSR outside the
Controller.

**1. Open the Controller Certificate card**

1. In CoPilot, go to **Settings > Configuration > General**.
2. Locate the **Controller Certificate** card.
3. Click **Upload Certificate**.
4. Select **Upload Certificate with Key**.

**2. Generate the private key**

On a Linux or macOS workstation, run:

```bash theme={null}
openssl genrsa -out my_priv.key 4096
```

**3. Generate the CSR**

Create the CSR from the private key:

```bash theme={null}
openssl req -new -sha256 -key my_priv.key -out controller.csr
```

Leave the challenge password blank when prompted.

**4. Obtain the signed certificates**

Submit the CSR to your trusted Certificate Authority. Wait for the CA to
return a signed **CA Certificate** and **Server Public Certificate** in PEM
format.

**5. Upload the certificate bundle**

1. Return to **Settings > Configuration > General** and open the
   **Controller Certificate** card.
2. Click **Upload Certificate**.
3. Select **Upload Certificate with Key**.
4. Click **Select** next to each of the following and choose the
   corresponding file:
   * **CA Certificate**
   * **Server Public Certificate**
   * **Server Private Key** (`my_priv.key`)
5. Click **Upload**.

## Change the Certificate Domain

Changing the certificate domain regenerates certificates for the Controller and
all managed gateways.

> [!WARNING]
>
> Changing the certificate domain disconnects all logged-in users. Perform this
> change only when your security requirements require it, and schedule the
> change during a maintenance window.

**1. Open the Certificate Domain tile**

In CoPilot, go to **Settings > Configuration > General** and locate the
**Certificate Domain** tile.

**2. Enter the new certificate domain**

1. In the **Certificate Domain** textbox, enter the certificate domain you
   want to use. To revert to the default, click **Reset To Default**.
2. Click **Save**.

**3. Confirm and apply**

1. Select **I understand the implications of changing the certificate
   domain.**
2. Click **Change**.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.