Skip to main content
Chariot v2.7 - v2.8.1

Obtain SSL Certificates for Chariot

Summary​

This tutorial explains how to obtain SSL/TLS certificates for securing HTTP and MQTT traffic in Chariot. The process is the same whether certificates are issued by a commercial Certificate Authority (CA) or an internal company CA.

Cirrus Link recommends using certificates issued by a trusted Certificate Authority instead of self-signed certificates when securing production environments.

Generate a Certificate Signing Request (CSR)​

Before requesting certificates from a Certificate Authority, generate a Certificate Signing Request (CSR) and the associated public/private keypair.

The private key generated during this process is required when configuring HTTPS and MQTTS in Chariot.

⚠️ Store the private key in a secure location. The private key is required when uploading certificates to Chariot.

CSR Requirements​

When generating the CSR:

  • Generate or select the keypair to associate with the certificate
  • Complete all required CSR fields
  • Verify the Common Name (CN) and Subject Alternative Names (SANs) match the Chariot hostname or domain

Submit the CSR to a Certificate Authority​

Submit the generated CSR to the Certificate Authority (CA) of your choice.

Depending on the Certificate Authority, you may be required to complete domain or organizational validation steps to verify ownership or control of the requested domain.

Certificates Provided by the CA​

After the CSR is approved, the Certificate Authority typically provides:

  • A signed SSL server certificate
  • A CA certificate chain file containing:
    • Root CA certificates
    • Intermediate CA certificates

The CA chain establishes the chain of trust required for clients to validate the server certificate.