> [!CAUTION]
> **Caution:** This documentation covers Edge for Private Cloud 4.52.00, which is no longer supported. Google does not provide security patches, bug fixes, or technical support for this version. The current supported version is 4.54.00. See the [Edge for Private Cloud documentation](https://docs.apigee.com/private-cloud/latest/overview) for the current version, or [All versions](https://docs.apigee.com/private-cloud/versions) to compare releases.

After you generate a signature request file, you must sign the request.

To sign the \*.csr file, execute the following command:

```
openssl x509 -req \
  -CA CA_PUBLIC_CERT \
  -CAkey CA_PRIVATE_KEY \
  -extensions cert_ext \
  -set_serial 1 \
  -extfile SIGNATURE_CONFIGURATION \
  -in SIGNATURE_REQUEST \
  -out LOCAL_CERTIFICATE_OUTPUT
```

Where:

- <var translate="no">CA_PUBLIC_CERT</var> is the path to your Certificate Authority's public key.
- <var translate="no">CA_PRIVATE_KEY</var> is the path to your Certificate Authority's private key.
- <var translate="no">SIGNATURE_CONFIGURATION</var> is the path to the file that you created in [Step 2: Create the local signature config file](https://docs.apigee.com/private-cloud/v4.52.00/mtls-certs-createsig).
- <var translate="no">SIGNATURE_REQUEST</var> is the path to the file that you created in [Build the signature request](https://docs.apigee.com/private-cloud/v4.52.00/mtls-certs-buildreq).
- <var translate="no">LOCAL_CERTIFICATE_OUTPUT</var> is the path at which this command creates the node's certificate.

This command generates the `local_cert.pem` and `local_key.pem` files. You
can use these files on a single node only in the Apigee mTLS installation. Each node must have its
own key/cert pair.

The following example shows a successful response for this command:

```
user@host:~/certificate_example$ openssl x509 -req \
  -CA certificate.pem \
  -CAkey key.pem \
  -extensions cert_ext \
  -set_serial 1 \
  -extfile request_for_sig \
  -in temp_request.csr \
  -out local_cert.pem

Signature ok
subject=C = US, ST = CA, L = San Jose, O = Google, OU = Google-Cloud, CN = Apigee
Getting CA Private Key

user@host:~/certificate_example$ ls

certificate.pem  key.pem  local_cert.pem  local_key.pem  request_for_sig  temp_request.csr
```

Your custom certificate/key pair is good for 365 days by default. You can configure the number
of days by using the `APIGEE_MTLS_NUM_DAYS_CERT_VALID_FOR` property, as described in
[Step 1: Update your configuration file](https://docs.apigee.com/private-cloud/v4.52.00/mtls-configure#updateconfig).

## Next Step


[1](https://docs.apigee.com/private-cloud/v4.52.00/mtls-certs-createpk)


[2](https://docs.apigee.com/private-cloud/v4.52.00/mtls-certs-createsig)


[3](https://docs.apigee.com/private-cloud/v4.52.00/mtls-certs-buildreq)


[4](https://docs.apigee.com/private-cloud/v4.52.00/mtls-certs-sign)


[NEXT: (5) Integrate](https://docs.apigee.com/private-cloud/v4.52.00/mtls-certs-integrate)