> [!CAUTION]
> **Caution:** This documentation covers Edge for Private Cloud 4.52.00, which is no longer supported. Google does not provide security patches, bug fixes, or technical support for this version. The current supported version is 4.54.00. See the [Edge for Private Cloud documentation](https://docs.apigee.com/private-cloud/latest/overview) for the current version, or [All versions](https://docs.apigee.com/private-cloud/versions) to compare releases.

After you create the local private key for a node, create its signature configuration file. Each
node must have its own version of the signature configuration file.

The following example shows the syntax for a signature configuration file:

```
[req]
distinguished_name = req_distinguished_name
attributes = req_attributes
prompt = no

[ req_distinguished_name ]
C=COUNTRY_NAME
ST=STATE_NAME
L=CITY_NAME
O=ORG_OR_BUSINESS_NAME
OU=ORG_UNIT
CN=ORG_DEPARTMENT

[ req_attributes ]

[ cert_ext ]
subjectKeyIdentifier=hash
keyUsage=critical,keyEncipherment,dataEncipherment
extendedKeyUsage=serverAuth,clientAuth
subjectAltName=@alt_names

[alt_names]
DNS.1=localhost
DNS.2=ipv4-localhost
DNS.3=ipv6-localhost
DNS.4=cli.dc-1.consul
DNS.5=client.dc-1.consul
DNS.6=server.dc-1.consul
DNS.7=FQDN
# ADDITIONAL definitions, as needed:
DNS.8=ALT_FQDN_1
DNS.9=ALT_FQDN_2

# REQUIRED (at least 1 IP address plus localhost definitions)
IP.1 = IP_ADDRESS
IP.2=0.0.0.0
IP.3=127.0.0.1
IP.4=::1
# ADDITIONAL definitions, as needed:
IP.5=ALT_IP_ADDRESS_1
IP.6=ALT_IP_ADDRESS_2
...
```

The following table describes the properties in the signature configuration file:

| Property | Required? | Description |
|---|---|---|
| `C` | Yes | A two-letter code for the nation in which the server is running. |
| `ST` | No | The state/province in which the server is running. |
| `L` | No | The city in which the server is running. |
| `O` | No | The name of the business running the server. |
| `OU` | No | Sub-division within the business. |
| `CN` | No | Sub-division within the business. |
| `DNS.[1...]` | Yes | DNS servers used by Consul. You must set `DNS.1` through `DNS.7`. Use `dc-1` for the data center, as the following example shows: ``` ... [alt_names] DNS.1=localhost DNS.2=ipv4-localhost DNS.3=ipv6-localhost DNS.4=cli.dc-1.consul DNS.5=client.dc-1.consul DNS.6=server.dc-1.consul DNS.7=FQDN ... ``` <var translate="no">FQDN</var> is the [Fully Qualified Domain Name](https://en.wikipedia.org/wiki/Fully_qualified_domain_name) of the network server that will use this certificate. For example, `nickdanger.la.corp.example.com`. To get the FQDN on a Linux server, use the following command: ``` hostname --fqdn ``` |
| `IP.[1...]` | Yes | Set `IP.1` to the valid [IPv4 address](https://en.wikipedia.org/wiki/IP_address) that every member of the cluster (including cross-data center traffic) observes this node as. In addition, Apigee requires that you include the following localhost definitions: ``` # REQUIRED (at least 1 IP address plus localhost definitions) IP.1=216.3.128.12 IP.2=0.0.0.0 IP.3=127.0.0.1 IP.4=::1 ``` If the node uses more than one IP address to communicate with other nodes, then specify additional IP addresses, each on a separate line; for example: ``` # REQUIRED (at least 1 IP address plus localhost definitions) IP.1=216.3.128.12 IP.2=0.0.0.0 IP.3=127.0.0.1 IP.4=::1 # ADDITIONAL definitions, as needed: IP.5=192.0.2.0 IP.6=192.0.2.1 ``` |

## Next Step


[1](https://docs.apigee.com/private-cloud/v4.52.00/mtls-certs-createpk)


[2](https://docs.apigee.com/private-cloud/v4.52.00/mtls-certs-createsig)


[NEXT: (3) Build the request](https://docs.apigee.com/private-cloud/v4.52.00/mtls-certs-buildreq)


[4](https://docs.apigee.com/private-cloud/v4.52.00/mtls-certs-sign)


[5](https://docs.apigee.com/private-cloud/v4.52.00/mtls-certs-integrate)