# Using real (not self-signed) certificates

**URL:** <https://forums.balena.io/t/using-real-not-self-signed-certificates/4371>\
**Category:** openBalena\
**Created:** [November 9, 2018, 12:45pm UTC](https://forums.balena.io/t/using-real-not-self-signed-certificates/4371 "2018-11-09T12:45:22Z")\
**Posts on this page:** 1\
**Showing post:** 24

<div class="post-metadata">

**Author:** ![phoenixmage](https://avatars.discourse-cdn.com/v4/letter/p/b5ac83/32.png) [@phoenixmage](https://forums.balena.io/u/phoenixmage)\
**Post date:** [March 13, 2019, 11:19am UTC](https://forums.balena.io/t/using-real-not-self-signed-certificates/4371/24 "2019-03-13T11:19:39Z")

</div>

I am interested in using an internally signed CA for my stuff so leveraging @richbayliss’s solution now it is merged I did the following.

- Generated a new private key
- Created a CSR which uses subject alt name for each required CNAME (registry, vpn, etc) in the CSR
- Signed the CSR with my internal CA
- Created open-balena.pem which contains the full cert chain and the private key appended

You can either find the physical location of the named cert volume (`docker volume inspect openbalena_certs` and look for Mountpoint) or copy the pem to `haproxy/open-balena.pem` and add `COPY open-balena.pem /certs/open-balena.pem` to the `haproxy/Dockerfile`

I needed to rebuild my haproxy container using `./scripts/compose up -d --build haproxy`

After that my cert CA signed cert is now used.

---

_[View the full topic](https://forums.balena.io/t/using-real-not-self-signed-certificates/4371)._