After you generate a signature request file, you must sign the request.

To sign the \*.csr file, execute the following command:

```
openssl x509 -req \
  -CA CA_PUBLIC_CERT \
  -CAkey CA_PRIVATE_KEY \
  -extensions cert_ext \
  -set_serial 1 \
  -extfile SIGNATURE_CONFIGURATION \
  -in SIGNATURE_REQUEST \
  -out LOCAL_CERTIFICATE_OUTPUT
```

Where:

- <var translate="no">CA_PUBLIC_CERT</var> is the path to your Certificate Authority's public key.
- <var translate="no">CA_PRIVATE_KEY</var> is the path to your Certificate Authority's private key.
- <var translate="no">SIGNATURE_CONFIGURATION</var> is the path to the file that you created in [Step 2: Create the local signature config file](https://docs.apigee.com/private-cloud/v4.52.02/mtls-certs-createsig).
- <var translate="no">SIGNATURE_REQUEST</var> is the path to the file that you created in [Build the signature request](https://docs.apigee.com/private-cloud/v4.52.02/mtls-certs-buildreq).
- <var translate="no">LOCAL_CERTIFICATE_OUTPUT</var> is the path at which this command creates the node's certificate.

This command generates the `local_cert.pem` and `local_key.pem` files. You
can use these files on a single node only in the Apigee mTLS installation. Each node must have its
own key/cert pair.

The following example shows a successful response for this command:

```
user@host:~/certificate_example$ openssl x509 -req \
  -CA certificate.pem \
  -CAkey key.pem \
  -extensions cert_ext \
  -set_serial 1 \
  -extfile request_for_sig \
  -in temp_request.csr \
  -out local_cert.pem

Signature ok
subject=C = US, ST = CA, L = San Jose, O = Google, OU = Google-Cloud, CN = Apigee
Getting CA Private Key

user@host:~/certificate_example$ ls

certificate.pem  key.pem  local_cert.pem  local_key.pem  request_for_sig  temp_request.csr
```

Your custom certificate/key pair is good for 365 days by default. You can configure the number
of days by using the `APIGEE_MTLS_NUM_DAYS_CERT_VALID_FOR` property, as described in
[Step 1: Update your configuration file](https://docs.apigee.com/private-cloud/v4.52.02/mtls-configure#updateconfig).

## Next Step


[1](https://docs.apigee.com/private-cloud/v4.52.02/mtls-certs-createpk)


[2](https://docs.apigee.com/private-cloud/v4.52.02/mtls-certs-createsig)


[3](https://docs.apigee.com/private-cloud/v4.52.02/mtls-certs-buildreq)


[4](https://docs.apigee.com/private-cloud/v4.52.02/mtls-certs-sign)


[NEXT: (5) Integrate](https://docs.apigee.com/private-cloud/v4.52.02/mtls-certs-integrate)