mps-cert

R2026b

Create root certificate authority and leaf certificate for a single server instance

Since R2026b

Syntax

mps-cert [-C [path/]server_name] [-f, --force-delete] [-l, --leaf-only] [--root-cert-exp-time root-cert-exp-time] [--root-dn-config-file root_dn_config_file] [--root-dn-str root_dn_string] [--san san] [--server-cert-exp-time server-cert-exp-time] [--server-dn-config-file server_dn_config_file][--server-dn-str server_dn_string] [-v, --verbose]

Description

mps-cert [-C [path/]server_name] [-f, --force-delete] [-l, --leaf-only] [--root-cert-exp-time root-cert-exp-time] [--root-dn-config-file root_dn_config_file] [--root-dn-str root_dn_string] [--san san] [--server-cert-exp-time server-cert-exp-time] [--server-dn-config-file server_dn_config_file][--server-dn-str server_dn_string] [-v, --verbose] generates a self-signed root certificate authority (CA), then a server certificate that is signed by the root certificate authority.

Input Arguments

-C path/

Path to the server instance.

If you want to generate a certificate for the server instance in the current working folder, you do not need to specify a full path; only specify the server name. If you omit this option, the system searches the current working folder and its parents to find the server instance.

server_name

Name of the server for which to generate a certificate.

--root-dn-config-file root-dn-config-file

A configuration file that contains the distinguished name of the root CA. This is optional.

--root-dn-str root-dn-string

A comma-separated string representing the distinguished name of the root CA. This is optional. The string should be in the format C=country,S=state,L=location,O=organization,OU=organizationUnit,CN=commonName.

--san san

A comma-separated string of Subject Alternative Name (SAN) entries for the server certificate. Each entry can be a DNS name or IP address. For example, --san "myhost.example.com,192.168.1.10,alt.example.com". If not provided, the value defaults to the server FQDN.

--server-dn-config-file server-dn-config-file

A configuration file that contains the distinguished name of the server certificate. This is optional.

--server-dn-str server-dn-string

A comma separated string representing the distinguished name for the server certificate. This is optional. The string should be in the format C=country,S=state,L=location,O=organization,OU=organizationUnit,CN=commonName.

--root-cert-exp-time root-cert-exp-time

Root certificate expiration time in days. This is optional. The default is 375 days.

--server-cert-exp-time server-cert-exp-time

Server certificate expiration time in days. This is optional. The default is 90 days.

-l | --leaf-only

Only generate leaf server certificate if the self-signed root CA is already generated. This is optional.

-f | --force-delete

Force delete of existing private key and certificate files before regenerating new ones. This is optional.

-v | --verbose

Whether to use verbose mode. This is optional.

Examples

Generate a self-signed certificate for the MATLAB® Production Server™ instance mpsTest.

Type the following at the system command prompt:

mps-cert -C /home/work/mpsTest
Generated Self-signed certificate for host1.example.com in /home/work/mpsTest/x509/ folder
Please set --x509-private-key to /home/work/mpsTest/x509/server_key.pem in main_config
Please set --x509-cert-chain to /home/work/mpsTest/x509/server_cert.pem in main_config
Please set --https to the desired HTTPS port number in main_config
Please import /home/work/mpsTest/x509/server_ca_cert.pem to client's trust store to avoid client warning or error.

This generates the files .server_ca_key.pem, server_ca_cert.pem, server_key.pem and server_cert.pem in the x509 folder. For more information about using the generated certificates, see Configure Client Authentication.

Tips

  • Run mps-cert from the server_install_location/script folder. Alternatively, add the script folder to your system PATH environment variable to run mps-cert from any folder on your system.

  • After running mps-cert -C path/server_name, set the --x509-private-key and --x509-cert-chain properties in the main_config file.

    1. Set --x509-private-key to <server_name>/x509/server_key.pem.

    2. Set --x509-cert-chain to <server_name>/x509/server_cert.pem.

    For more information, see Server Configuration Properties.

  • If the server certificate expires, you can run mps-cert -C path/server_name -l -f to regenerate the server certificate and restart the server.

  • If both the root certificate and server certificate expire, you can use mps-cert -C path/server_name -f to regenerate both the root and server certificate and restart the server. Then, import the new <instance_root>/x509/server_ca_cert.pemfile into the client's trust store.

Version History

Introduced in R2026b

See Also

| | | | |

Topics