Stage 2 · mTLS Identity

Your certificate,
generated here.

Your key pair is generated in this browser. A certificate signing request is sent to the entityOS mTLS issuer, signed by the private CA, and returned as a ready-to-install .p12 — one single-use access code per certificate.

Algorithm RSA-2048 · SHA-256
Validity 365 days
Access code Single use
mTLS Certificate
1
Details
2
Key gen
3
Sign
4
Download
Generating RSA-2048 key pair…

Provided by your administrator. Works once.

Embedded as the Subject Alternative Name in your certificate.

Install your certificate

Password:

Your .p12 file has been downloaded automatically. If not, download it here.

macOS
  1. Double-click the .p12 — Keychain Access will open.
  2. For Keychain: change iCloud to login.
  3. Enter the password above when prompted.
  4. Restart your browser — it will present the certificate on the next mTLS connection.
Windows
  1. Double-click the downloaded .p12 — Certificate Import Wizard will open.
  2. Select Current User, click Next.
  3. Enter the password above when prompted.
  4. Place the certificate in Personal store, click Finish.
  5. Restart your browser — it will present the certificate on the next mTLS connection.
iPhone / iPad
  1. Open this page on your iPhone, then tap the download link above to save the .p12.
  2. Tap the .p12 file — iOS will prompt to install a profile.
  3. Go to Settings → General → VPN & Device Management and tap the downloaded profile.
  4. Tap Install and enter your device passcode.
  5. Enter the certificate password above when prompted.
  6. Safari will now present your certificate automatically for entityOS mTLS services.
Android
  1. Tap the download link above to save the .p12 to your device.
  2. Go to Settings → Security → Encryption & credentials → Install a certificate.
  3. Select VPN & app certificate (or User certificate depending on your device).
  4. Browse to and select the .p12 file.
  5. Enter the certificate password above when prompted.
  6. Give the certificate a name (e.g. entityOS) and tap OK.
  7. Chrome on Android will now present your certificate for entityOS mTLS services.

Optional

Your certificate was issued by the entityOS mTLS private CA. The CA certificate is bundled inside the .p12; download it separately if a tool needs the CA on its own.

macOS: Double-click the downloaded .pem → Keychain Access → expand Trust → set When using this certificate to Always Trust. Windows: Double-click → Install Certificate → Place in Trusted Root Certification Authorities. macOS: Double-click the downloaded .pem → Keychain Access → expand Trust → set When using this certificate to Always Trust.  |  Windows: Double-click → Install Certificate → Place in Trusted Root Certification Authorities.

Keep this file secure. Your private key is the credential that proves your identity to entityOS. Store it in a password manager or encrypted vault. Do not share it, email it, or commit it to source control.

Under the hood

How your certificate is created

01
Key pair generation

Your browser uses the Web Cryptography API (window.crypto.subtle) to generate an RSA-2048 key pair. Once installed, the private key lives in your device's certificate store.

Browser
02
Certificate Signing Request

The browser constructs a PKCS#10 CSR containing your public key, a unique common name, and your email address as a Subject Alternative Name, then sends it with your single-use access code.

Browser
03
Signing by the entityOS private CA

The issuer verifies the CSR signature, checks the access code is valid and unused, and signs your public key with the entityOS mTLS CA — producing an X.509 client certificate (clientAuth) valid for 365 days by default. The code is marked used and an issuance record (serial, fingerprint, public certificate) is written to encrypted S3. The private key is never stored.

Server
04
PKCS#12 packaging & download

The signed certificate, the CA certificate and your private key are packaged into a PKCS#12 (.p12) protected by a random password, and the file downloads automatically. Install it once and your browser presents it on every connection to the mTLS-protected load balancer.

Server