To manually create an identity certificate for another device:

1. Check the setting Platform ViewSettingsGeneralCertificatesIdentity CertificatesCreate certificate for a different machine.
2. Enter the Machine IP. This is used to create the file name, but not the certificate itself; an IPv4 address of that device should be entered.
3. Enter the Password. This is used to secure the identity certificate file and must conform to the complexity requirements.
4. Enter a unique subject name for the device. See Certificate Name Content for more information.
5. Enter any subject alternative names.
6. Enter the number of days the certificate will be valid for. The start date/time will be the current UTC time of the server. The end date/time will be start time + number of days. Identity certificates should not be valid for more than three years (1095 days). The longer the period, the greater the risk of certificate compromise.
7. Enter the Public Key Algorithm. This should be RSA-2048 for all IP Office devices. RSA-1024 should only be used for legacy systems that cannot support RSA-2048.
8. Enter the Secure Hash Algorithm. This should be SHA-256 for all IP Office devices. SHA-1 should only be used for legacy systems that cannot support SHA-256.
9. Check the settings and then click Generate. This will cause the server to generate a PKCS#12 file containing the identity certificate, private key and signing certificate. The file is secured by the password entered and will be requested every time the file is opened.
10. A popup will prompt to save the file. Save the file to the local machine. Once the popup is close, the file will be deleted on the CA server.
11. The PKCS#12 file can now be imported into the IP Office deployment. See Update Certificates and Implementing IP Office PKI for more information.