Existing Certificate

Already have CA certificate for correct Domain/IP

If you already have a certificate from a public CA (Certificate Authority), then simply input the relative path to the Certificate, Private key and optionally Passphrase when prompted. Make sure your domain or IP matches the machine's IP.

Already have Self-signed certificate for correct Domain/IP

Same as above with the addition that When using Self-signed certs the user needs to import Certificate or the CA into their "Trusted Root Certificate Authorities" store on the device.
This is done by opening "Manage user certificates" and navigating to the "Trusted Root Certificate Authorities" right-clicking the Certificates folder within, then All Tasks -> Import.
After this you follow the instructions in the new window, if you can't see your .pem files make sure the filter in the file explorer includes them.
Then test if the API is setup correctly, in a browser go to:
https://YOUR_IP_OR_HOSTNAME/api/warmup.
Expected response is "Warming up server!"

New Certificate

Prepare Tooling

Install OpenSSL

If you do not have a certificate already you will need to acquire or generate one, for this we recommend using OpenSSL version:(Win64 OpenSSL v3.4.0).
Installation exe can be found for download here.

Run executable choosing these settings: Accept terms -> choose file location (C:\Program Files\OpenSSL Win64) -> The Windows system directory -> Install.

Configure OpenSSL

After running the exe, you will need to set a path in the system variables. To do this navigate to Settings -> System -> About -> Advanced system settings -> Environment Variables.

Once here find the line called "Path" under the system variables.
Click Edit -> New, then input the path to the \bin folder of your installation location for OpenSSL, e.g. "C:\Program Files\OpenSSL-Win64\bin".

Then just click OK all the way out again. Now you are ready to generate certs with OpenSSL. Alternatively if you do not wish to use OpenSSL, you can use Microsoft’s own tools.
Documentation for this can be found here.

Generate Certificate Signing Request (CSR)

Each command used will create a file at terminal location. Therefore, make sure your terminal is pointing at your desired location before using commands.
Create an RSA key by running this command. It outputs a cert-key.pem file containing an RSA key used in generating your Certificate Signing Request.

Create a Certificate Signing Request (CSR)

This will output a CSR file, this is what you will either send to a CA to get signed or self-sign with your own created CA.
The key used for this CSR and the cert you get back from a CA is what is needed for the API.
The Common Name (AKA CN) represents the server name protected by the TLS certificate.
The certificate is valid only if the request hostname matches the certificate common name or any of the subject alternative names which we will be setting in later steps.

When you have generated the CSR, continue to create the certificate for the appropriate scope, each documented in the following sections:

Get issued a CA-signed certificate
Create self-signed certificate

Get issued a CA-signed Certificate (Public CA-signed)

Use the generated CSR to send to a Public CA to get issued a Certificate for your domain or IPs.

Create Certificate (self-signed)

Create a cnf file with all the alternative names.
These are the domains and IPs for which the cert will be Valid for.
SubjectAltName= is the parameter that holds all the valid domains and IPs.
Each of the entries are comma separated and has either a DNS: for the domains or IP: is for the IPs.
In the command below insert your own domain and IP in place of “Example.com” & “127.0.0.1”.

Verify that the resulting cnf file is UTF-8 encoded. You can do so by opening it in a notepad and checking the bottom right corner. If it is not UTF-8, save the notepad as UTF-8, make sure the extension is still .cnf.

Create the certificate from your CSR

The key used for the CSR and the resulting certificate is what will be used in the API.
Be aware of the line breaks when copy & pasting commands into CMD, as the command will not be run with all parameters - the command below must be executed in one line in commandline

When using Self-signed certificates, the user needs to import Certificate "Trusted Root Certificate Authorities" store on the device.
This is done by opening "Manage user certificates" and navigating to the "Trusted Root Certificate Authorities" store, right-clicking the Certificates folder within, then All Tasks -> Import.
After this you follow the instructions in the new window, if you can't see your .pem files make sure the filter in the file explorer includes them.

You now should have a usable certificate for use with accoPLANING self-hosted API, proceed to Encryption Keys if you have yet to generate them.

Reference for accoTOOL Self-Hosted API