Apigee mTLS requires that a certificate and key exist on each node in the cluster.

To generate the certificate, choose one of the following options:

- **If you have your own, established Certificate Authority (CA):** Use it to generate your certificate and key, as described in this section.
- **If you do not have a CA:** Apigee recommends that you install Consul and use it to generate the certificate/key pair. For more information, see [Step 2: Install Consul and generate credentials](https://docs.apigee.com/private-cloud/v4.52.02/mtls-configure#installconsul).

> [!NOTE]
> **NOTE:** While each node will have its own unique local key/cert pair, all nodes use the same CA's key/cert pair. Both the local key/cert pair and the CA's key/cert pair must be present on each node.

This process consists of the following steps, which you must perform on each node:

1. **[Create the private key](https://docs.apigee.com/private-cloud/v4.52.02/mtls-certs-createpk)** for the node. Each node must have a unique private key.
2. **[Create the signature config](https://docs.apigee.com/private-cloud/v4.52.02/mtls-certs-createsig)** for the node. Each node must have its own signature configuration file.
3. **[Build the request](https://docs.apigee.com/private-cloud/v4.52.02/mtls-certs-buildreq)** by converting the signature configuration file into a signature request file.
4. **[Sign the request](https://docs.apigee.com/private-cloud/v4.52.02/mtls-certs-sign)** so that you can get a local key/cert pair for the node.
5. **[Integrate](https://docs.apigee.com/private-cloud/v4.52.02/mtls-certs-integrate)** all the key/cert pairs with your nodes.

Apigee recommends that you perform steps 1 through 4 for all nodes, and then perform step 5 for
all nodes, rather than walking through all 5 steps for each node, one at a time.

[Get Started!](https://docs.apigee.com/private-cloud/v4.52.02/mtls-certs-createpk)