---
title: "Creating a Self-Signed Certificate for RPZ Logs"
canonical: "https://docs.infoblox.com/space/BloxOneCloud/35398725/Creating%20a%20Self-Signed%20Certificate%20for%20RPZ%20Logs"
format: markdown
---
To create a self-signed certificate, do the following:

**Step 1**: Create a CA certificate:

`openssl req -nodes -new -newkey rsa:2048 -sha256 -x509 -keyout CA.key -out CA.cert -subj "/C=IN/ST=KA/L=Bglr/O=Infoblox/OU=Cloud/CN=*"`

By default, the certificate will remain valid for one month. To modify this period, add the **-days **flag. In the example below, the flag specifies the period as one year: 

`openssl req -nodes -new -days 365 -newkey rsa:2048 -sha256 -x509 -keyout CA.key -out CA.cert -subj "/C=IN/ST=KA/L=Bglr/O=Infoblox/OU=Cloud/CN=*"`

**Step 2**: Create a key and CSR:

`openssl req -batch -new -newkey rsa:2048 -sha256 -nodes -keyout server.key -out rpz.csr -subj "/C=IN/ST=KA/L=Bglr/O=Infoblox/OU=SAAS/CN=<IPaddress/FQDN>"`

Example:

`openssl req -batch -new -newkey rsa:2048 -sha256 -nodes -keyout server.key -out rpz.csr -subj "/C=IN/ST=KA/L=Bglr/O=Infoblox/OU=SAAS/CN=192.168.30.50"`

or

`openssl req -batch -new -newkey rsa:2048 -sha256 -nodes -keyout server.key -out rpz.csr -subj "/C=IN/ST=KA/L=Bglr/O=Infoblox/OU=SAAS/CN=cdc.example.com"`

> ℹ️ Note: IP address or FQDN of the Data Connector. FQDN support on NIOS is available only from NIOS version 9.0.5 and above.

**Step 3**: Create a server certificate, and sign it with the CA certificate you created in step 1:

`openssl x509 -in rpz.csr -out server.cert -CAkey CA.key -CA CA.cert -req -CAcreateserial`

<span style="color: #172b4d">By default, the server certificate is good for one month. To modify this period, add the </span><span style="color: #172b4d">**-days **</span><span style="color: #172b4d">flag. In the example below, the flag specifies the period as one year:</span>

`openssl x509 -in rpz.csr -out server.cert -CAkey CA.key -CA CA.cert -req -CAcreateserial -days 365 `

<span style="color: #1d1c1d">**Step 4**</span><span style="color: #1d1c1d">: Combine the server certificate and the key into a single .pem file to be uploaded in the Infoblox Portal.</span>

<span style="color: #1d1c1d">cat server.cert server.key > server.pem</span>

**Step 5**: <span style="color: #1d1c1d">Use CA.cert in the NIOS appliance to configure the secure TCP.</span>


For information on configuring RPZ logs in NIOS, see *[Managing RPZs](https://infoblox-docs.atlassian.net/wiki/spaces/nios90/pages/280402532)*. 

For information on SCP credentials for transferring DNS query logs, see *[Capturing DNS Queries and Responses](https://infoblox-docs.atlassian.net/wiki/spaces/nios90/pages/280403128)*.