// Module included in the following assemblies:
//
// * cloud_experts_osd_tutorials/cloud-experts-osd-update-component-routes.adoc

:_mod-docs-content-type: PROCEDURE
[id="cloud-experts-osd-update-component-routes-create-tls-certificates_{context}"]
= Creating TLS certificates for each component route

[role="_abstract"]
Create three self-signed certificates, one for each component route. Trust them on your system so you can open each new hostname in a browser.

[WARNING]
====
Use this flow for learning only, not for production. For live systems, request valid certificates from your certificate authority (CA).
====

[IMPORTANT]
====
Use one certificate per route to prevent issues with HTTP/2 connection coalescing. Wildcard certificates and subject alternative names (SAN) certificates are not supported.
====

This example uses the following custom component routes:

* `console.example.com` for Console
* `downloads.console.example.com` for Downloads
* `oauth.console.example.com` for OAuth

.Procedure
* For each route, run the example `openssl` commands. Set `-subj` to that route's domain name:
+
.Example output:
[source,bash]
----
$ openssl req -newkey rsa:2048 -new -nodes -x509 -days 365 -keyout key-console.pem -out cert-console.pem -subj "/CN=console.example.com"
$ openssl req -newkey rsa:2048 -new -nodes -x509 -days 365 -keyout key-downloads.pem -out cert-downloads.pem -subj "/CN=downloads.console.example.com"
$ openssl req -newkey rsa:2048 -new -nodes -x509 -days 365 -keyout key-oauth.pem -out cert-oauth.pem -subj "/CN=oauth.console.example.com"
----

.Verification

* Check that the `.pem` certificate and key files exist:
+
[source,bash]
----
$ ls -1 *.pem
----
+
.Example output
[source,text]
----
cert-console.pem
cert-downloads.pem
cert-oauth.pem
key-console.pem
key-downloads.pem
key-oauth.pem
----