Types of SSL certificates in KVM on RHEL 9.6

Last Updated : Oct 30, 2026 |
Prolog information
Metadata
Keywords:
Note:
Cockpit certificates are stored under /etc/cockpit/ws-certs.d/

Default System Generated Self-Signed Certificates

When KVM on RHEL 9.6 gets deployed a system generated self-signed certificate for Cockpit (RHEL Web UI) gets created. Certificate information has a fixed system default configuration: asp130-r660xs, localhost, 127.0.0.1.
System generated self-signed certificates auto-renew and have a default (configurable) expiry of 395 days. These also auto-regenerate by the system if removed by the user.
Example:
[custadm@asp130-r660xs ~]$ sudo ls -lrt /etc/cockpit/ws-certs.d/
[sudo] password for custadm:
total 12
-rw-------. 1 root root 1704 Aug 11 07:21 0-self-signed.key
-rw-r--r--. 1 root root 1769 Aug 11 07:21 0-self-signed.cert
-rw-r--r--. 1 root root 2204 Aug 11 07:21 0-self-signed-ca.pem
 

User Generated Self-Signed Certificates

A new, user generated self-signed certificate can be generated on demand to replace the default Cockpit SSL certificate with the proper server information during or after server implementation.
User generated SSL certificates can be created with a much longer expiry of a year e.g. 10 years, however best security practices recommend a 1-year expiry. User must renew and keep up with “user generated SSL certificates”.

Custom CA signed Certificates

Secure, strongly recommended. Aligns with industry security best practices. Can be created on demand by user.
SSL Certificates can be created with a much longer expiry than a year e.g., 10 years, however, best security practices recommend a 1-year expiry. Users must renew and keep up with custom certificates. Including certificate revocation.
Organizational CA can be used such us Microsoft Windows Server or Avaya Aura® System Manager to sign and generate certificates.