> For the complete documentation index, see [llms.txt](https://docs.autommate.com/userguide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.autommate.com/userguide/administration-and-runtimes/certificates-and-tls.md).

# Prepare certificates and troubleshoot TLS

Prepare a certificate for the hostname users and components will connect to, then verify its chain before installation. Use the certificate format required by the component receiving it.

The examples below use OpenSSL and the illustrative hostname `autom.example.com`. Replace the filenames and hostname with your own approved values. Protect the working directory: a private key and a PFX containing it are secrets.

## 1. Create a key and certificate request

If your certificate authority or organization supplies its own request process, follow that process. Otherwise, this example creates an encrypted RSA private key and a certificate-signing request with a DNS subject alternative name:

```bash
openssl req -new -newkey rsa:2048 -keyout private-key.pem -out autom.csr -addext "subjectAltName=DNS:autom.example.com"
```

Enter the private-key passphrase interactively and keep it in the approved secret store. Submit the CSR to your certificate authority; keep the private key private. See the [OpenSSL request reference](https://docs.openssl.org/3.6/man1/openssl-req/).

## 2. Check the issued certificate

Obtain the server certificate and the issuing intermediate certificates. Confirm the required hostname, issuer and validity dates:

```bash
openssl x509 -in server-cert.pem -noout -subject -issuer -dates -ext subjectAltName
```

Check that the private key belongs to this certificate before building the bundle. The [OpenSSL certificate reference](https://docs.openssl.org/3.6/man1/openssl-x509/) describes inspection and public-key output options.

## 3. Create the PFX bundle

Place the intermediate certificates in `intermediates.pem`, in the chain order supplied by the certificate authority. Include a root certificate only if the destination's import requirements call for it.

```bash
openssl pkcs12 -export -out autom.pfx -inkey private-key.pem -in server-cert.pem -certfile intermediates.pem -name "Autom Center"
```

The command prompts for the key passphrase and PFX export password. Use an export password accepted by the destination and store it securely. Check the container without exporting private-key material:

```bash
openssl pkcs12 -in autom.pfx -info -noout
```

Use the algorithms supported by the destination. See the [OpenSSL PKCS#12 reference](https://docs.openssl.org/3.6/man1/openssl-pkcs12/); do not enable legacy algorithms simply to bypass an unexplained import failure.

## 4. Install or replace the certificate

Record the active certificate, expiry date and configured endpoint before a replacement. Back up the required configuration and prepare a recovery path. Import the bundle using the procedure for the installed Autom Center or Agent component, then apply the required reload or service restart within the maintenance window.

Test the actual hostname from the user network and from any Agent or integration host that relies on it. Confirm that the new certificate is served and the full chain is trusted by those clients. Repeat a small authenticated operation after the change.

## Troubleshooting

| Symptom                              | Check                                                           |
| ------------------------------------ | --------------------------------------------------------------- |
| Hostname mismatch                    | DNS name used by the caller is present in the certificate's SAN |
| Untrusted issuer                     | Intermediate chain and the calling process's trust store        |
| Expired or not-yet-valid certificate | Validity dates and host clock                                   |
| PFX import failure                   | Password, key/certificate match and supported bundle algorithms |
| Browser works, Agent fails           | Agent process trust configuration, endpoint name and proxy path |
| Old certificate still appears        | Correct listener/binding, proxy termination and required reload |

Avoid disabling certificate validation as a permanent fix. Capture the certificate error, hostname and timestamp for investigation; omit private keys, PFX passwords and authorization tokens.