---
title: "Certificates for secure operation"
canonical: "https://docs.cuesystem.com/space/ADMINWEB/275153183/Certificates%20for%20secure%20operation"
format: markdown
---
> ℹ️ You can use the certificates inserted in this way for the secure connection using 802.1X protocol and as the SSL certificate for the Web Admin pages. Certificate settings for this purpose are performed on the "[Configuration / 802.1X](https://cue.atlassian.net/wiki/spaces/ADMINWEB/pages/274857991)" and "[Configuration / Web" pages](https://cue.atlassian.net/wiki/spaces/ADMINWEB/pages/274661449)”.

On the "Certificates" page, you can manage the certificates required for the secure operation of the reservation system. This setting must be made for all units of the reservation system.

To set the certificates for **AdminWeb** and **802.1X**, click "Certificates" in the upper part of the screen.

![image](media://d49a876a-252c-499b-aa95-61438a91225f)

You have two options for uploading the certificate to the unit.

### Upload from file

You can **upload a certificate from the file** in the "**Import certificate**" page section. Certificate, private key, and intermediate certificate in PKCS #12 and x509 (PEM, DER) format are supported. The private key password must be specified if the private key is encrypted. Tap the "**Choose file**" button next to appropriate items, select the file and upload it. If the certificate is intended for 802.1x, you can optionally upload the server CA certificate. Then upload a new certificate using the "**Upload**" button. 

### Obtain from SCEP server

The second option is to **obtain a certificate from the SCEP server**. The SCEP server is used to obtain a new certificate and also to automatically renew this certificate. 

> ℹ️ SCEP server must be part of your IT infrastructure.

The SCEP server is set in the "**Create signing certificate request**" section.

- Set "**Use SCEP**" to value "**Yes**".
- Fill in the following mandatory parameters of the certificate request: "**SCEP server URL"**, "**SCEP CA ident name**", "**Common name (CN)**" and "**Challenge password**".
- Other parameters are optional.
- If the SCEP server requires a private key length longer than 1024 bits, please switch the parameter "**Private key length**" to value 2048 or 4096 according to your SCEP server and security requirements.
- Press the button "**Create**".
- A newly created certificate request will appear on the page.


- If the SCEP server is reachable by the touchONE unit and all parameters in the certificate request are correct, a new certificate is obtained from the SCEP server. Information that the certificate has been obtained is displayed on the page. Columns "**Issued by**" and "**Valid until**" are filled in.


- If an error occurs when obtaining a new certificate (or renewing a certificate, see below), the text "**Yes**" in column "**SCEP**" is red. The error description is visible in the tooltip or in the edit dialog. Press the button "**Edit**" to show the edit dialog.


> ℹ️ **Support for certificate renewal is implemented in the unit.** Before the certificate issued by the SCEP server expires, the unit automatically requests the SCEP server to renew the certificate (SCEP Certificate Renewal). Technically, the way it works is that the existing certificate is used to renew the certificate.  Once the renewed certificate is retrieved from the SCEP server, the renewed certificate is automatically used.  To renew the certificate, the SCEP server must support this operation and then the whole process works automatically. A new certificate is not created in the certificate list, but the original certificate is renewed. Therefore, there is no need to reconfigure the purpose (Web server, 802.1X) for which the certificate is used.