# InsightVM Certificate Invalid **URL:** \ **Category:** InsightVM\ **Created:** [October 5, 2022, 1:39pm UTC](https://discuss.rapid7.com/t/insightvm-certificate-invalid/15844 "2022-10-05T13:39:16Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![DeckerBilliam](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/deckerbilliam/32/1584_2.png) [@DeckerBilliam](https://discuss.rapid7.com/u/DeckerBilliam)\ **Post date:** [October 5, 2022, 1:39pm UTC](https://discuss.rapid7.com/t/insightvm-certificate-invalid/15844/1 "2022-10-05T13:39:17Z")
Morning folks in R7 Land, I’ve been trying to get this resolved, but I’ve hit a real wall on this one. We have been getting cert errors for our API’s due to our self signed cert not being approved by a CA. So I went ahead finally and submitted the CSR to my CA, uploaded return key value. Restarted console. No Change Using this Reference document > **[Managing the Security Console | InsightVM Documentation](https://docs.rapid7.com/insightvm/managing-the-security-console/#managing-the-https-certificate)** > > Learn how to adjust your Security Console settings and make configuration changes. It is not accurate or I’m maybe not aligning my request right. I’ve attempted to do the SAN Section of the document since I figured I am getting this signed by my organizations CA _ **### IMPORTANT** _ _**Consoles using externally signed (CA/non-CA) must have a SAN field. If the certificate is self signed, it does not require a SAN field.**_ ![image](https://forum-uploads-hub-prod-1-us-east-1-rapid7-com.s3.dualstack.us-east-1.amazonaws.com/original/2X/3/3a8af9563907f03fb3b6810a56b1265d1afa7d2c.png) **cd [install\_dir]/rapid7/nexpose/\_jvm1.8.0\_232/bin** No longer valid folder. I do see something similar to it (\_jvm1.8.0\_332) and CD into it after Sudo -su or sudo -i into it **./keytool -certreq -alias nscweb -sigalg sha512WithRSA -keystore /opt/rapid7/nexpose/nsc/keystores/nscweb.ks -storepass ‘r@p1d7k3y$t0r3’ -ext san=‘dns:samplehostname.com,ip:127.0.0.1’ -file filename.csr** if you attempt to run that, you get a permission denied error (I am doing this as root user) ![image](https://forum-uploads-hub-prod-1-us-east-1-rapid7-com.s3.dualstack.us-east-1.amazonaws.com/original/2X/8/89a53d222433e34303af37daa027a3a579b7fe7e.png) Any help on how to get this squared away would be much appreciated. ---
**Author:** ![john\_hartman](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/john_hartman/32/1255_2.png) [@john\_hartman](https://discuss.rapid7.com/u/john_hartman)\ **Post date:** [October 5, 2022, 4:44pm UTC](https://discuss.rapid7.com/t/insightvm-certificate-invalid/15844/2 "2022-10-05T16:44:24Z")
When you run that command, you need to swap out the dns name and IP to your actual values. Your command shows that you were still using the sample name and loopback address. Also before you get to this step you should have already generated the new cert and CSR from the GUI. Try making those changes and running again. The contents of that “filename.csr” is what you will need to copy/paste into your CA to be signed. ---
**Author:** ![DeckerBilliam](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/deckerbilliam/32/1584_2.png) [@DeckerBilliam](https://discuss.rapid7.com/u/DeckerBilliam)\ **Post date:** [October 5, 2022, 5:25pm UTC](https://discuss.rapid7.com/t/insightvm-certificate-invalid/15844/3 "2022-10-05T17:25:16Z")
Hey John, long time no chat. > When you run that command, you need to swap out the dns name and IP to your actual values. Your command shows that you were still using the sample name and loopback address. > > Also before you get to this step you should have already generated the new cert and CSR from the GUI. Appreciate that clarification. That makes sense and adds up. I can modify the command to match my FQDN and Server IP. Do we need to include the port association on it? To my second point in the post, ![image](https://forum-uploads-hub-prod-1-us-east-1-rapid7-com.s3.dualstack.us-east-1.amazonaws.com/original/2X/1/14cf7edf516900ccef8f1ae5d5c484447558282a.png) Any pointers? ---
**Author:** ![john\_hartman](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/john_hartman/32/1255_2.png) [@john\_hartman](https://discuss.rapid7.com/u/john_hartman)\ **Post date:** [October 5, 2022, 5:37pm UTC](https://discuss.rapid7.com/t/insightvm-certificate-invalid/15844/4 "2022-10-05T17:37:22Z")
Yes, you were right that the jvm version has changed so you were right to go into the updated folder name. However, looking at the directory you’re in, it doesn’t match up to the command you’re running and where it expects to find those files. Given by your screenshot the top level directory you show is “data” and we expect it to be installed in “opt”. You should simply be able to swap out the directory name in the command. ---
**Author:** ![DeckerBilliam](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/deckerbilliam/32/1584_2.png) [@DeckerBilliam](https://discuss.rapid7.com/u/DeckerBilliam)\ **Post date:** [October 5, 2022, 5:52pm UTC](https://discuss.rapid7.com/t/insightvm-certificate-invalid/15844/5 "2022-10-05T17:52:57Z")
Switched the directory, got the following pipe ![image](https://forum-uploads-hub-prod-1-us-east-1-rapid7-com.s3.dualstack.us-east-1.amazonaws.com/original/2X/c/cb661a453c8a30a367a0475fcc8492a4124e7554.png) ---
**Author:** ![john\_hartman](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/john_hartman/32/1255_2.png) [@john\_hartman](https://discuss.rapid7.com/u/john_hartman)\ **Post date:** [October 5, 2022, 5:54pm UTC](https://discuss.rapid7.com/t/insightvm-certificate-invalid/15844/6 "2022-10-05T17:54:31Z")
perfect, that’s expected. Grab the contents of the filename.csr in that directory you’re in now and that’s what you will send off to be signed by your CA. ---
**Author:** ![DeckerBilliam](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/deckerbilliam/32/1584_2.png) [@DeckerBilliam](https://discuss.rapid7.com/u/DeckerBilliam)\ **Post date:** [October 5, 2022, 6:06pm UTC](https://discuss.rapid7.com/t/insightvm-certificate-invalid/15844/7 "2022-10-05T18:06:47Z")
Dope. I submitted to my CA now and will wait for them to provide return. I’ll update the thread once I know better. Thanks as always John for your insight 🙂 ---
**Author:** ![DeckerBilliam](https://discuss.rapid7.com/user_avatar/discuss.rapid7.com/deckerbilliam/32/1584_2.png) [@DeckerBilliam](https://discuss.rapid7.com/u/DeckerBilliam)\ **Post date:** [October 6, 2022, 5:24pm UTC](https://discuss.rapid7.com/t/insightvm-certificate-invalid/15844/8 "2022-10-06T17:24:03Z")
![image](https://forum-uploads-hub-prod-1-us-east-1-rapid7-com.s3.dualstack.us-east-1.amazonaws.com/original/2X/5/5ccf37d3a01e4717b92efc0085672019e5485be0.png) So got back from the CA the signed CSR. Performed Stop, Start after import URL shows secure However, issue we are seeing with API tools ![image](https://forum-uploads-hub-prod-1-us-east-1-rapid7-com.s3.dualstack.us-east-1.amazonaws.com/original/2X/2/2d07631e06095db332d2a4b3b1e5009d77827db6.png) or ![image](https://forum-uploads-hub-prod-1-us-east-1-rapid7-com.s3.dualstack.us-east-1.amazonaws.com/original/2X/d/d7209d862d4f40780fe2637587bda692cbcef479.png)