1. Create Remote Manager (server) certificate:

Note that this certificate requires the following extensions:

X509v3 Basic Constraints: critical
CA:TRUE
X509v3 Subject Alternative Name:
IP Address:[Remote Manager IP]

If you are using openSSL, the CA extension will come automatically. This is not the case for the SAN however. You can find what exact IP Remote Manager is using in the file - "[RM Install Dir]/bin/mserver/mprm.prs":

mprm.host.address=192.168.202.222

Then, one way to configure it (assuming you are on Linux):

Open file - /etc/ssl/openssl.cnf

Under the [ v3_ca ], put the following:

subjectAltName = @alt_names
[alt_names]
IP = [Remote Manager IP]


Generate the certificate:

openssl genrsa -out rmserver.key 2048
 
openssl req -new -x509 -key rmserver.key -out rmserver.cer

2. Create Edge certificate:

openssl genpkey -out edge.key -algorithm RSA -pkeyopt rsa_keygen_bits:2048
 
openssl req -new -key edge.key -out edge.csr
 
echo 1234 > serial.txt
 
openssl x509 -CA rmserver.cer -CAkey rmserver.key -CAserial serial.txt -req -in edge.csr -out edge.cer -days 365


The deivceId will be taken from the certificate's CommonName. If the common name does not match the deviceId the connection will be terminated.

The unstructured address can be configured in openssl by editing the /etc/ssl/openssl.cnf, and adding the following line at:

"[ req_distinguished_name ]": unstructuredAddress = Unstructured Address

The deviceId must follow the format:

<namespace>:<thing-name>

3. Import the Remote Manager (server) certificate in Certificate Manager

Follow the same instructions to upload the certificate, as we described in the Rollouts part, but select domain "mPRM TLS Server, mPRM RAS" this time.