Configure Certificates - Netskope Technical Documentation

Server side certificates are required to enable SSL inspection. You can use either a self-signed CA certificate or a CA certificate preferably signed by the enterprise’s Root or intermediate CA.

Alternatively, the DLP On Demand appliance can generate a self-signed certificate without CA.

Use your own CA Certificates

Enter configure mode by typing configure:
```
nsappliance> configure
```
Enter the command:
```
nsappliance(config)# set dlpaas server-cert
```
Copy and paste your CA certificate in the buffer, press Enter , then type Ctrl-D to exit.
Enter the command:
```
nsappliance(config)# set dlpaas server-key
```
Copy and paste your private key in the buffer, press Enter , then type Ctrl-D to exit.
Enter the command:
```
nsappliance(config)# set dlpaas server-intermediate-ca-chain
```
Copy and paste any additional certificates in the following order:
1. Server certificate (as provided in step 1)
2. Intermediate CA certificate
3. Root CA certificate
Enter save and press Enter to save the configuration.

Generate a Self-signed Certificate without CA

When configuring DLP on Demand inside of AI Gateway, after generating the self signed certificate, run the show command and copy the generated server certificate before running save command. Once the save command is run, the server certificate will not be shown anymore in the show output.

A self-signed certificate is already provided when the appliance is initialized; however, if you would like to replace it, follow these steps:

Enter configure mode by typing configure:
```
nsappliance> configure
```

To generate a self-signed certificate, run the following command:

run request certificate generate self-signed city <city> common-name <common-name> country <country> days <days> email-address <email-address> organization <organization> organization-unit <organization-unit> state <state>

Here’s an example command to generate a self-signed certificate:

nsappliance(config)# run request certificate generate self-signed city "Santa Clara" common-name "dlpondemand.example.com" organization "example" organization-unit "example cert authority" state "CA" country "US" email-address "admin@example.com"

Enter save and press Enter to save the configuration.
```
nsappliance(config)# save
```