After installation, the application server generates a so-called self-signed certificate, which browsers will flag with a warning. You can replace it with your own certificate.
🚨 The certificate cannot be replaced in the cloud — even if the command appears to succeed. Replacing the certificate only makes sense on your own or a local installation.
Certificate requirements
It must be in PEM format.
The file must contain both the public part (certificate) and the private part (key).
The key must be in PKCS#1 or PKCS#8 format, either unencrypted or encrypted. This means the PEM file must contain a section starting with one of the following headers:
BEGIN RSA PRIVATE KEY
BEGIN PRIVATE KEY
BEGIN ENCRYPTED PRIVATE KEY
The file must contain the entire certificate chain, including the root authority's certificate.
Uploading the certificate
The certificate is uploaded using the PUT method to the /certificate address of the application server. The request body is the PEM file itself:
PUT https://server:5434/certificate.json?password=abc
<obsah souboru domena.eu.pem>
The certificate must either have no password — in which case the password parameter can be omitted — or its password must be provided in this parameter. In the database, the certificate is always stored without a password.
⚠️ The endpoint only accepts the PUT method — any other method returns 405 Method Not Allowed. Also note that the SSL certificate can only be replaced while the API service is active.
After uploading, you need to restart the application server, otherwise the new certificate will not take effect.
Required permissions
In the request, you authenticate using the username and password of an ABRA Flexi user who must have ADMIN rights including the server-level "Manage licenses" permission — the ADMIN user role alone is not sufficient. You can learn more about permissions in the article How to work with users.
ℹ️ If the import fails to complete, check out the article SSL certificate import ends with an error — it describes the most common causes.