---
title: "Generating Self-Signed Certificates"
description: "To generate self-signed TLS certificates, Veeam ONE uses RSA algorithm with a 2048-bit key length and SHA-2 hashing algorithm. The created TLS certificate is saved to the Shared certificate store."
canonical: "https://helpcenter.veeam.com/docs/one/userguide/certs_self_signed.html"
breadcrumb: "User Guide > Security Guidelines > Veeam ONE Certificates > Generating Self-Signed Certificates"
dateModified: "2026-10-23"
---

# Generating Self-Signed Certificates

To generate self-signed TLS certificates, Veeam ONE uses RSA algorithm with a 2048-bit key length and SHA-2 hashing algorithm. The created TLS certificate is saved to the *Shared* certificate store. The following types of users can access the generated TLS certificate:

- User who created the TLS certificate
- LocalSystem user account
- Local Administrators group

::: note

When you generate a self-signed TLS certificate with Veeam ONE, you cannot include several aliases to the certificate and specify a custom value in the *Subject* field. The *Subject* field value is taken from the Veeam ONE license installed on Veeam ONE Server.

:::

To generate a new self-signed TLS certificate, do the following:

1. Run the Veeam ONE Settings utility.

   For more information, see [Veeam ONE Settings Utility](appendix.md).

2. In the **Server** section, open the **Web API Certificate** tab.
3. Click **Generate**.
4. To use a newly generated certificate, in the displayed window, click **Yes**.

[![Security Certificate Settings](images/utility_certificate.png "Security Certificate Settings")](images/utility_certificate.png){.toggle scale=70}

::: note

If you replace the default certificate with another self-signed certificate, you must configure a trusted connection between the Veeam ONE Web Client and a web browser later. For details, see [Accessing Veeam ONE Components](access.md).

:::