Create a key and certificate
Your server proves its identity by signing requests with an RSA private key. Ryno only ever receives the matching public certificate. The private key never leaves your infrastructure.
Certificate requirements
| Requirement | Value |
|---|---|
| Key type | RSA, 2048 bits or more. EC keys are not accepted. |
| Format | X.509 certificate, PEM or base64 DER. |
| Issuer | Self-signed is accepted. No chain is checked. |
| Basic Constraints | Present, with CA:FALSE. |
| Key Usage | Present, including digitalSignature. |
| Validity | Already valid, with at least 30 days left. |
Generate them
One command creates both files. It needs OpenSSL 1.1.1 or later.
openssl req -x509 -newkey rsa:3072 -sha256 -days 730 -nodes \
-keyout ryno-partner.key \
-out ryno-partner.crt \
-subj "/CN=your-company-ryno-partner" \
-addext "basicConstraints=critical,CA:FALSE" \
-addext "keyUsage=critical,digitalSignature"
| File | What it is | Where it goes |
|---|---|---|
ryno-partner.key | Private key | Your secrets manager or HSM. Nowhere else. |
ryno-partner.crt | Public certificate | The Partner Portal, in the next step. |
danger
Never send the private key to Ryno, commit it to source control, or paste it into a shared tool. Ryno will reject any upload that contains a private key.
Check the certificate
openssl x509 -in ryno-partner.crt -noout -subject -enddate -ext basicConstraints,keyUsage
You should see CA:FALSE, Digital Signature, and an end date well in the future.
info
Plan the validity period now. A registered certificate cannot be replaced from the portal, so a two-year certificate avoids an early rotation. See Token lifecycle.