[Yandex Cloud documentation](../../../index.md) > [Yandex Certificate Manager](../../index.md) > [Step-by-step guides](../index.md) > Custom certificate > Adding a certificate

# Adding a custom certificate

In this article, we will add a self-signed certificate as an example of a custom certificate. Check the custom certificate requirements in [Custom certificate](../../concepts/imported-certificate.md).

## Creating a self-signed certificate file {#create-file}

To create a self-signed certificate using the `OpenSSL` library, run this command:

{% list tabs group=programming_language %}

- Bash {#bash}

  ```bash
  openssl req -x509 -newkey rsa:4096 -nodes \
    -keyout key.pem \
    -out cert.pem \
    -days 365 \
    -subj '/CN=example.com'
  ```

- PowerShell {#powershell}

  ```PowerShell
  openssl req -x509 -newkey rsa:4096 -nodes `
    -keyout key.pem `
    -out cert.pem `
    -days 365 `
    -subj '/CN=example.com'
  ```

{% endlist %}

Where:
* `-x509`: To output a certificate file.
* `-newkey`: To create a new private key file.
* `rsa:4096`: Algorithm and key length.
* `-nodes`: Do not encrypt the private key file.
* `-keyout`: Name of the file to save the private key to.
* `-out`: Certificate file name.
* `-days`: Certificate validity period.
* `-subj`: Certificate owner's Common Name value.

If you run the `req` command with the above parameters, it will issue a self-signed certificate and generate the associated private key.

## Adding a self-signed custom certificate {#create-certificate}

To add a custom certificate to Certificate Manager:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) to add a custom certificate to.
  1. Navigate to **Certificate Manager**.
  1. Click **Add certificate**.
  1. In the menu that opens, select **User certificate**.
  1. In the window that opens, in the **Name** field, enter a custom certificate name.
  1. Optionally, in the **Description** field, describe your custom certificate.
  1. In the **Certificate** field, click **Add certificate**.
     1. Choose how to add it: `File`.
     1. Click **Attach file**.
        1. In the window that opens, select the `cert.pem` self-signed certificate file.
     1. Click **Add**.
  1. In the **Private key** field, click **Add private key**.
     1. Choose how to add it: `File`.
     1. Click **Attach file**.
        1. In the window that opens, select the `key.pem` private key file.
     1. Click **Add**.
  1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. View the command description:

     ```bash
     yc certificate-manager certificate create --help
     ```

  1. Run this command:

     ```bash
     yc certificate-manager certificate create \
       --name mycert \
       --chain mycert.pem \
       --key mykey.pem
     ```

     Where:
     * `--name`: Certificate name.
     * `--chain`: Path to the certificate chain file.
     * `--key`: Path to the certificate private key file.

     Result:

     ```text
     id: fpqmg47avvim********
     folder_id: b1g7gvsi89m3********
     created_at: "2020-09-15T06:54:44.916325Z"
     ...
     issued_at: "2020-09-15T06:54:44.916325Z"
     not_after: "2021-09-15T06:48:26Z"
     not_before: "2020-09-15T06:48:26Z"
     ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. In the configuration file, describe the resources you want to create:

     ```hcl
     resource "yandex_cm_certificate" "user-certificate" {
       name    = "<certificate_name>"

       self_managed {
         certificate = <<-EOT
                       -----BEGIN CERTIFICATE-----
                       <certificate_contents>
                       -----END CERTIFICATE-----
                       EOT
         private_key = <<-EOT
                       -----BEGIN PRIVATE KEY-----
                       <contents_of_certificate_private_key>
                       -----END PRIVATE KEY-----
                       EOT
       }
     }
     ```

     Where:
     * `name`: Certificate name.
     * `certificate`: [Certificate](../../concepts/imported-certificate.md) file contents.
     * `private_key`: Private key file contents.

     For more on the properties of the `yandex_cm_certificate` resource, see [this provider guide](../../../terraform/resources/cm_certificate.md).
  1. Create the resources:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

  This will add the certificate to the specified folder. You can check the new certificate and its settings using the [management console](https://console.yandex.cloud) or this [CLI](../../../cli/quickstart.md) command:

    ```bash
     yc certificate-manager certificate get <certificate_name>
    ```

- API {#api}

  To add a certificate, use the [create](../../api-ref/Certificate/create.md) REST API method for the [Certificate](../../api-ref/Certificate/index.md) resource or the [CertificateService/Create](../../api-ref/grpc/Certificate/create.md) gRPC API call.

{% endlist %}

A new certificate with the `Issued` status will appear in the certificate list.

## Storing a certificate's private key in Yandex Lockbox {#create-lockbox}

To avoid storing a private key of the user certificate as plain text in the Terraform configuration file, write it to [Yandex Lockbox](../../../lockbox/index.md):

{% list tabs group=instructions %}

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. [Create a secret](../../../lockbox/operations/secret-create.md) and write the private key to it.
  1. In the configuration file, specify the properties of the resources you want to create:

     ```hcl
     resource "yandex_cm_certificate" "example-lockbox" {
       name = "<secret_name>"

       self_managed {
         certificate = <<-EOT
                       -----BEGIN CERTIFICATE-----
                       <certificate_contents>
                       -----END CERTIFICATE-----
                       EOT
         private_key_lockbox_secret {
           id  = "<secret_ID>"
           key = "<secret_key>"
         }
       }
     }
     ```

     Where:
     * `name`: Yandex Lockbox [secret](../../../lockbox/concepts/secret.md) name.
     * `certificate`: Certificate file contents.
     * `id`: ID of the Yandex Lockbox secret containing the private key.
     * `key`: Key of the Yandex Lockbox secret containing the private key.

     For more on the properties of the `yandex_cm_certificate` resource, see [this provider guide](../../../terraform/resources/cm_certificate.md).
  1. Create the resources:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

  This will add the certificate to the specified [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder). You can check the new certificate and its settings using the [management console](https://console.yandex.cloud) or this [CLI](../../../cli/index.md) command:

  ```bash
  yc certificate-manager certificate get <certificate_name>
  ```

{% endlist %}

A new certificate with the `Issued` status will appear in the certificate list.