# Create mTLS certificate for Production request
source: https://developer.mastercard.com/identity-insights-for-transactions/documentation/tutorials-and-guides/certificate-creation-tutorial/index.md

## Introduction {#introduction}

MTLS (Mutual Transport Layer Security) is a mutual authentication method for a secure connection between client and server. The Key Management Portal (KMP) is an application available in [Mastercard Connect](https://www.mastercardconnect.com/-/sign-in) as a self-service portal for Mastercard customers, which allows them to request and exchange keys and certificates with Mastercard. The portal provides guided workflows to create and manage requests for key and certificate exchange, as well as an inventory of all PKI for keys and certificates that have been exchanged between you and Mastercard using KMP.

### Prerequisites {#prerequisites}

To access KMP, your company must be registered with Mastercard. Once your company has been setup and given a company identifier (CID), you can sign up for Mastercard Connect.
To sign up, go to [www.Mastercardconnect.com](https://www.mastercardconnect.com/-/sign-in) then click **Sign up**. Please contact your Mastercard representative to get help with Mastercard Connect Signup.

## Registration and Access to the Key Management Portal (KMP) {#registration-and-access-to-the-key-management-portal-kmp}

* Sign in at [www.Mastercardconnect.com](https://www.mastercardconnect.com/-/sign-in)
* Click Store in the top menu.
* Search for "Key Management Portal card" to **Open** it. You can also select "Administration" under Business capabilities to narrow down the search results.

![](https://static.developer.mastercard.com/content/identity-insights-for-transactions/uploads/kmp_store.png)

* On the Key Management Portal card, select **Request**.
* Select **Security Officer Level 1** access.
* Click **Request access**.
* A request for access to KMP was submitted to your Mastercard Connect Security Administrator. The designated Security Administrators within your company must approve your request.

## Launching the KMP Application {#launching-the-kmp-application}

* Sign in to [Mastercard Connect](https://www.mastercardconnect.com)
* Click **My Items**.
* Click on the Key Management Portal card to **Open** it.

## Complete the set up in KMP {#complete-the-set-up-in-kmp}

* Your company must have at least 2 active Security Officers on the Key Management Portal to be permitted to create new requests in KMP. If you see the following message when logging into KMP then your company needs to have at least 1 additional Security Officer registered on the Key Management Portal application in Mastercard Connect. To get registered, see Registration and Access to the Key Management Portal. ![](https://static.developer.mastercard.com/content/identity-insights-for-transactions/uploads/kmp_setup_alert.png)
* **Furthermore,** a **Certificate Management Group email** must be added to your company profile.

## Adding your Certificate Management Group email {#adding-your-certificate-management-group-email}

* Your Certificate Management Group email is an alternative means of communication which the Mastercard Key Management Delivery team will use for crucial communication with your organization and in case there is no longer an active user on the Key Management Portal.
* Follow below steps to add a Certificate Management Group email:

### 1. Click My Company. {#1-click-my-company}

![](https://static.developer.mastercard.com/content/identity-insights-for-transactions/uploads/kmp_connect.png)

### 2. Click on the pencil icon next to Certificate Management Group Email. {#2-click-on-the-pencil-icon-next-to-certificate-management-group-email}

![](https://static.developer.mastercard.com/content/identity-insights-for-transactions/uploads/kmp_company_details.png)

### 3. Enter your Certificate Management Group email and click Save. {#3-enter-your-certificate-management-group-email-and-click-save}

![](https://static.developer.mastercard.com/content/identity-insights-for-transactions/uploads/kmp_group_gmail.png)

## Generate CSR {#generate-csr}

A CSR is an encoded file that provides a standardized way to send a public key as well as some information that identifies your company and domain name. This method will keep your private key secure, at no time will Mastercard see it or be able to recover it.

* Generate a CSR as per the Mastercard Identity Insights application DN requirements.

### Common Name: CID {#common-name-cid}

### Organization: Customer Name {#organization-customer-name}

### Organization Unit: Client-PRD-MII {#organization-unit-client-prd-mii}

### Country: 2-digit ISO Country code {#country-2-digit-iso-country-code}

* This CSR is required to be uploaded on the Certificate Request Form.
* Once you upload your CSR file, Mastercard sets a default 364-day expiry period for the API Signing certificate.
* Commands to generate the CSR: The CSR itself should be generate in Base-64 PEM format. You can open the CSR file using a simple text editor. Use the following commands to create a CSR file.

```XML
openssl req -out certreq.csr -key cakey.pem -new
Enter pass phrase for cakey.pem:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields, but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:
Organization Name (eg, Customer Name) [ABC Pvt Ltd]:
Organizational Unit Name (eg, Client-MTF-MII) []:
Common Name (e.g. CID) []:123

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

$ ls
cacert.pem  cakey.pem  certreq.csr
```

## In the above command: {#in-the-above-command}

* req **option means you are creating a Certificate Request (pkcs10)**
* -newkey rsa:2048 **means you are generating a new RSA key of 2048 bits in size**
* -x509 **means you are outputting an x509 structure instead of a cert req**
* -keyout cakey.pem **is the private key**
* -out cacert.pem **is the public certificate**

Note: To know more about the requirements your CSR must meet, refer to [Mastercard Requirements for CSRs](https://developer.mastercard.com/platform/documentation/security-and-authentication/csr-requirements/).

## Request certificate in KMP {#request-certificate-in-kmp}

* Navigate to Certificate Request Form to create the new certificate request.
* Select "Mastercard Identity Insights" as the Mastercard application name , "New Certificate" as request type and "Production" as the environment.

![](https://static.developer.mastercard.com/content/identity-insights-for-transactions/uploads/kmp_certificate_request.png)

* Select "Next"
* Select Certificate Profile as "Client" and enter the Mastercard Project Contact Email id.
* Then it shows the DN requirements.

![](https://static.developer.mastercard.com/content/identity-insights-for-transactions/uploads/kmp_certificate_request01.png)

## Download the certificate/CA Chain/File {#download-the-certificateca-chainfile}

* Login to KMP.
* On the Detail Screen, click **Actions** then **Download**.

![](https://static.developer.mastercard.com/content/identity-insights-for-transactions/uploads/kmp_download.png)

* Ensure that the "Format PKCS #8" option is selected.

![](https://static.developer.mastercard.com/content/identity-insights-for-transactions/uploads/kmp_download01.png)

* Select the preferred ordering of Root CA (unless you select the DER format in which case the Root Chain cannot be included).

![](https://static.developer.mastercard.com/content/identity-insights-for-transactions/uploads/kmp_download02.png)

* **Press Download**

The downloaded file will be saved in the default download folder of your browser.

## Following are the several outcomes that may be observed: {#following-are-the-several-outcomes-that-may-be-observed}

* The root chain is always included in the downloaded file containing the certificate and chaining:
  * The downloaded file is a .pem file
  * An extra CA Chain is delivered along with the certificate chaining inside a zip file