Generate Self-Signed SSL Certificates

Use the packaged Polarity CLI to generate the server certificate and private key, then restart the containers to load them.

Applies To

Standard Polarity Server v5 Docker installations under /app. Use the gen-certs command in /app/bin/polarity.sh instead of the older generate_certs.sh utility.

Version Scope: This procedure has been validated with the approved CA-constraints fix applied to the lab CLI. The fix is not yet part of a published installer release. Before activating newly generated certificates on an unpatched build, verify that the generated root contains CA:TRUE and certificate-signing key usage, and that the server chain verifies.

Before You Begin

Have administrative access to the Docker host and record the fully qualified domain name (FQDN) and IP address clients will use. Back up the current certificates, matching keys, CA files, and relevant configuration. Schedule a maintenance window.

Arrange distribution of the public trust certificate to every required workstation. Do not distribute a private key. A locally generated certificate does not become trusted by clients simply because the server presents it.

Generate the Certificates

On the Polarity Server, run the packaged command with permission to replace the certificate files. From an administrative shell, use:
```
cd /app && ./bin/polarity.sh gen-certs
```
Enter the server FQDN and IP address when prompted. The command generates the certificate and key and places them in the required v5 locations.
Check the certificate SANs, dates, and key match using Prepare Certificate and Private Key Files. Verify the chain against its public CA certificate. Ensure the installed files retain the ownership, permissions, and labels required by the container processes.
Distribute the public trust certificate through your workstation management process before testing client access.
Restart the Docker containers from the server.
```
cd /app && ./down.sh && ./up.sh
```

Verify the Result

Complete the TLS and application checks in Install or Replace a Server Certificate. Confirm that a representative browser and Polarity Client trust the certificate and can use the server.

Recover or Undo