---
title: "Manage SSL/TLS certificates in Trellix ePolicy Orchestrator"
slug: "create-a-self-signed-certificate-with-openssl"
tags: ["Product Usage", "ePolicy Orchestrator – On-prem", "ePO 5.10.x", "ePO 5.10.0"]
updated: 2026-10-07T12:49:16Z
published: 2026-10-07T12:49:16Z
canonical: "docs.trellix.com/create-a-self-signed-certificate-with-openssl"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trellix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage SSL/TLS certificates in Trellix ePolicy Orchestrator

ePO - On-prem uses a self-signed certificate to secure HTTPS communication with web browsers. There are two types of self-signed certificate:

- **Default self-signed certificate** — Generated by ePO - On-prem. You can renew it from the ePO console when needed.
- **Custom self-signed certificate** — A certificate you create yourself, for example with OpenSSL, and import to replace the default certificate.

| To do this | See |
| --- | --- |
| Renew the default self-signed certificate | [Renew the default ePO self-signed certificate](/v1/docs/create-a-self-signed-certificate-with-openssl#renew-the-default-epo-selfsigned-certificate) |
| Create a custom self-signed certificate and use it in place of the default certificate | [Create and import a custom SSL certificate with OpenSSL](/v1/docs/create-a-self-signed-certificate-with-openssl#create-and-import-a-custom-ssl-certificate-with-openssl) |

> [!NOTE]
> Note:
> 
> To have a third party, for example Verisign or Microsoft Windows Enterprise Certificate Authority, create a signed certificate for ePO - On-prem, see [***How to use OpenSSL to generate a custom TLS certificate for the ePO browser console connection***](https://support.trellix.com/s/article/KB72477).

## Renew the default ePO self-signed certificate

The default ePO (Tomcat) self-signed certificate can be renewed if needed by regenerating it in the ePO console, and then restarting the ePO services.

> [!NOTE]
> Note:
> 
> This task applies to the default self-signed certificate. To create a custom certificate, see [Create and import a custom SSL certificate with OpenSSL](/v1/docs/create-a-self-signed-certificate-with-openssl#create-and-import-a-custom-ssl-certificate-with-openssl).

1. Select **Menu** → **Configuration** → **Server Settings**.
2. From the **Setting Categories** list, select **Server Certificate**, and click **Edit** at the bottom right corner.
3. Under **New certificate**, select **Regenerate a self-signed certificate and private key**, and click **Save**.
4. After the changes are saved, restart the ePO services:
  1. Press **Windows+R**.
  2. Type `services.msc` into the field and press **Enter**.
  3. Right-click each of the following services, and select **Restart**:
    - Trellix ePolicy Orchestrator 5.10.0 Application Server
    - Trellix ePolicy Orchestrator 5.10.0 Event Parser Service
    - Trellix ePolicy Orchestrator 5.10.0 Server

After you restart the ePO services, the ePO (Tomcat) self-signed certificate is in use.

## Create and import a custom SSL certificate with OpenSSL

You can use the OpenSSL toolkit to create a custom self-signed certificate and import it into ePO to replace the default certificate.

Sometimes you might not be able to, or want to, wait for a certification authority to authenticate a certificate. During initial testing or for systems used on internal networks, a custom self-signed certificate can provide the basic security and functionality needed.

There are many tools you can use to create and self-sign a certificate. This task describes the process using OpenSSL for Windows software. To have a third party, for example Verisign or Microsoft Windows Enterprise Certificate Authority, create a signed certificate for ePO - On-prem, see [How to generate a custom SSL certificate for use with ePO using the OpenSSL toolkit](https://support.trellix.com/s/article/KB72477).

### Before you begin

Install the OpenSSL for Windows software. OpenSSL is available from:

[http://www.slproweb.com/products/Win32OpenSSL.html](http://www.slproweb.com/products/Win32OpenSSL.html)

The file structure used in the following task is:

- `C:\ssl\` — Installation folder for OpenSSL.
- `C:\ssl\certs\` — Used to store the certificates created.
- `C:\ssl\keys\` — Used to store the keys created.
- `C:\ssl\requests\` — Used to store the certification requests created.

OpenSSL does not create these folders by default. They are used in these examples and can be created to help you find your output files.

> [!NOTE]
> Note:
> 
> We recommend that you use certificates with RSA public key lengths of 2048 bits or greater.

1. To generate the initial certificate key, type the following command at the command line:

`C:\ssl\bin>openssl genrsa -des3 -out C:/ssl/keys/ca.key 2048`

The following screen appears.

```plaintext
Loading 'screen' into random state - done
Generating RSA private key, 2048 bit long modulus
........................++++++
.++++++
unable to write 'random state'
e is 65537 (ox10001)
Enter pass phrase for keys/ca.key:
Verifying - Enter pass phrase for keys/ca.key:
C:\ss\bin>
```
2. Enter a passphrase at the initial command prompt and verify the pass phase at the second command prompt.

> [!NOTE]
> Note
> 
> Make a note of the passphrase you enter. You need it later in the process.

The file name `ca.key` is generated and stored in the path `C:\ssl\keys\`.

The key looks similar to the following example.

![GUID-CADE61FD-140F-40A1-A884-1F1F3092F084-low.png](https://cdn.us.document360.io/0d453a50-e1da-4d4a-9409-fea7959614d8/Images/Documentation/uuid-45088fb7-9bd0-77af-80e4-3fa1ef1a9766.png?sv=2026-02-06&spr=https&st=2026-11-14T09%3A19%3A08Z&se=2026-11-14T10%3A19%3A08Z&sr=c&sp=r&sig=iFvUyULG8f15ypYhRXCCygT59RgF9Pk4tL%2BWs16aHYQ%3D)
3. To self-sign the certificate key you created, type the following command at the command line:

`openssl req -new -x509 -days 365 -key C:/ssl/keys/ca.key -out C:/ssl/certs/ca.cer`

> [!NOTE]
> Note:
> 
> *Some web browsers no longer accept certificates signed with the SHA-1 hash algorithm. Make sure your custom certificate and its certificate chain are signed with SHA-256. For details, see* [ERR_SSL_VERSION_OR_CIPHER_MISMATCH](https://support.trellix.com/s/article/KB96903) (when you access the ePO on-premises console on a web browser)*.*

The following screen appears.

![GUID-6B133B13-E172-4F27-B15E-4829B7ADDB03-low.png](https://cdn.us.document360.io/0d453a50-e1da-4d4a-9409-fea7959614d8/Images/Documentation/uuid-b97bd955-4c23-94a3-281a-b49c5d1ec83b.png?sv=2026-02-06&spr=https&st=2026-11-14T09%3A19%3A08Z&se=2026-11-14T10%3A19%3A08Z&sr=c&sp=r&sig=iFvUyULG8f15ypYhRXCCygT59RgF9Pk4tL%2BWs16aHYQ%3D)

Type the information needed after the following command prompts:

  - `Country Name (two letter code) [AU]:`
  - `State or Province Name (full name) [Some-State]:`
  - `Locality Name (for example, city) []:`
  - `Organization Name (for example, company) [Internet Widgits Pty Ltd]:`
  - `Organizational Unit Name (for example, section) []:`
  - `Common Name (for example, YOUR name) []:`

> [!NOTE]
> Note
> 
> At this command prompt, type the name of your server, for example your ePO - On-prem server name.
  - `Email Address []:`

The file named `ca.cer` is generated and stored in the path `C:\ssl\certs\`.

The self-signed certificate looks similar to the following example.

![GUID-3055936B-114D-4D3C-856D-098C0D57A53B-low.png](https://cdn.us.document360.io/0d453a50-e1da-4d4a-9409-fea7959614d8/Images/Documentation/uuid-51a62e34-9192-2d11-0939-1bfcc6c92fd1.png?sv=2026-02-06&spr=https&st=2026-11-14T09%3A19%3A08Z&se=2026-11-14T10%3A19%3A08Z&sr=c&sp=r&sig=iFvUyULG8f15ypYhRXCCygT59RgF9Pk4tL%2BWs16aHYQ%3D)
4. To upload the self-signed certificate, open the **Edit Server Certificate** page.
  1. Select **Menu** → **Configuration** → **Server Settings**.
  2. From the **Setting Categories** list, select **Server Certificate**, and click **Edit**.
5. Browse to the server certificate file, then click **Open**.

In this example, browse to `C:\ssl\certs\` and select `ca.cer`.
6. If needed, type the PKCS12 certificate password.
7. If needed, type the certificate alias name.
8. Browse to the private key file, then click **Open**.

In this example, browse to `C:\ssl\keys\` and select `ca.key`.
9. If needed, type the private key password, then click **Save**.
10. Restart ePO - On-prem for the change to take effect.