Skip to main content

Steps to getting a certificate issued

In the Web UI, open the API Integrations section. There you'll find quick instructions on how to get a certificate issued. Here we'll go through the steps in more detail.

note

After performing the following steps an OAuth client with an automatically generated client_id will be created. The client_id will be used in the requests to get an access token. Multiple OAuth clients per account are not yet supported.

Generate a key pair and a CSR​

On your own machine, generate a private key and a Certificate Signing Request:

Windows doesn't ship openssl. Install it once:

winget install FireDaemon.OpenSSL

Then generate the private key and CSR:

openssl ecparam -name prime256v1 -genkey -noout -out client.key
openssl req -new -key client.key -out client.csr -sha256 -subj "/"

Your private key (client.key) never leaves your machine — only the CSR (client.csr) is uploaded.

A few things to note:

  • Algorithm: Only ECDSA on the P-256 curve with SHA-256 is accepted. CSRs using RSA, Ed25519, or other ECDSA curves are rejected.
  • Attributes: All CSR attributes and extensions are dropped; only the public key is carried over.
  • Subject: The CN (or any other subject field) you put in the CSR is ignored — the server replaces the subject with the client_id of the OAuth client.

Upload the CSR​

In the API Integrations section, upload client.csr for signing. As this is a sensitive operation, you'll be asked to confirm it with your password.

Download the certificate​

Once signed, download the issued certificate. The file is a bundle containing two certificates: your leaf certificate (valid for 1 year) followed by the Intermediate CA certificate that signed it. You'll be able to download it again from the Web UI.

You can inspect it with:

openssl x509 -in client.crt -noout -subject -issuer

# Expected output
# subject=CN={client_id}
# issuer=CN=TransferGo Production Intermediate CA1, O=TransferGo, C=LT

Use the bundle as-is together with your private key when establishing mTLS connections.

Next steps​