---
version: "2026"
language: "en"
---
# Create a self-signed certificate for recording traffic in Leapwork Go

This article explains how to generate a self-signed certificate bundle that Leapwork Go can use to record HTTPS traffic. The scripts mirror the bundled Leapwork Go Recorder certificate workflow and generate the PEM files required for upload.  
This is only required if you choose to use your own self-signed certificate instead of the default certificate provided by Leapwork.

After generating a new certificate and uploading it to the Admin Portal, it must be added to the Trusted Root Certification Authorities store on all user machines. If this step is not completed, recording functionality will not work as expected.

## Before you start

Make sure:

* OpenSSL is installed and available in your terminal or PowerShell session.

* You use an empty folder so the generated files are easy to find.

## Install OpenSSL (if needed)

### Windows

* Download and install OpenSSL for Windows from Shining Light Productions:

  <https://slproweb.com/products/Win32OpenSSL.html>

* After installation, open a new PowerShell window and run:

    openssl version

### macOS

If OpenSSL is not already available:

Install Homebrew:

    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Install OpenSSL:

    brew install openssl

Verify:

    openssl version

## Generate the certificate on macOS

Use this script on macOS to create the certificate and key files that Leapwork Go needs for HTTPS traffic recording.

1. Save the script below as `generate-leapGo-certificate.sh` in an empty folder.

       #!/bin/bash
       set -euo pipefail
       SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
       cd "$SCRIPT_DIR"
       OPENSSL_BIN="$(command -v openssl)"
       if [ -z "$OPENSSL_BIN" ]; then
         echo "OpenSSL is required but was not found in PATH."
         exit 1
       fi
       cat > cert.cnf <<'EOF'
       [ req ]
       default_bits       = 4096
       prompt             = no
       default_md         = sha256
       distinguished_name = dn
       req_extensions     = req_ext
       [ dn ]
       C  = US
       O  = <Your organization name>
       CN = <Leapwork Go Recorder CA>
       [ req_ext ]
       basicConstraints = critical,CA:TRUE
       keyUsage = critical, keyCertSign, cRLSign
       subjectKeyIdentifier = hash
       EOF
       "$OPENSSL_BIN" req -x509 -newkey rsa:4096 -keyout mitm-key.pem -out mitm-cert.pem -days 365 -nodes -config cert.cnf -extensions req_ext
       "$OPENSSL_BIN" pkcs8 -topk8 -inform PEM -in mitm-key.pem -out key_pkcs8.pem -nocrypt
       cat mitm-cert.pem key_pkcs8.pem > bundle.pem
       echo "Generated files:"
       ls -1 mitm-cert.pem mitm-key.pem key_pkcs8.pem bundle.pem

2. Replace `<Your organization name>` and `<Leapwork Go Recorder CA>` if needed.

3. Run:

    chmod +x generate-leapGo-certificate.sh
    ./generate-leapGo-certificate.sh

## Generate the certificate on Windows

1. Open PowerShell.

2. Save the script below as `Generate-LeapGo.ps1` in an empty folder.

       $ErrorActionPreference = 'Stop'
       $ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
       Set-Location $ScriptDir
       $opensslCommand = Get-Command openssl.exe -ErrorAction SilentlyContinue
       if (-not $opensslCommand) {
           $opensslCommand = Get-Command openssl -ErrorAction Stop
       }
       $openssl = $opensslCommand.Source
       @'
       [ req ]
       default_bits       = 4096
       prompt             = no
       default_md         = sha256
       distinguished_name = dn
       req_extensions     = req_ext
       [ dn ]
       C  = US
       O  = <Your organization name>
       CN = <Leapwork Go Recorder CA>
       [ req_ext ]
       basicConstraints = critical,CA:TRUE
       keyUsage = critical, keyCertSign, cRLSign
       subjectKeyIdentifier = hash
       '@ | Set-Content -Path cert.cnf -Encoding ascii
       & $openssl req -x509 -newkey rsa:4096 -keyout mitm-key.pem -out mitm-cert.pem -days 365 -nodes -config cert.cnf -extensions req_ext
       & $openssl pkcs8 -topk8 -inform PEM -in mitm-key.pem -out key_pkcs8.pem -nocrypt
       Get-Content .\mitm-cert.pem, .\key_pkcs8.pem | Set-Content -Path .\bundle.pem -Encoding ascii
       Write-Host 'Generated files:'
       Get-ChildItem .\mitm-cert.pem, .\mitm-key.pem, .\key_pkcs8.pem, .\bundle.pem

3. In the script, replace `Your organization name` with your company name.

4. Keep `Leapwork Go Recorder CA` as the certificate name, or replace it with your preferred common name.

5. Run:

    Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
    .\Generate-LeapGo.ps1

## Files generated

The scripts generate these files:

* `mitm-cert.pem`: public certificate in PEM format.

* `mitm-key.pem`: private key in PEM format.

* `key_pkcs8.pem`: private key converted to PKCS#8 PEM format.

* `bundle.pem`: combined PEM file that includes `mitm-cert.pem` and `key_pkcs8.pem` for upload.

Keep `mitm-key.pem`, `key_pkcs8.pem`, and `bundle.pem` secure.  
![image-20260319-122201.png](https://docs.leapwork.com/__attachments/a_e01e2583813978ba359d7cbf13f62eb9ed336e421ced782bc3dc2c2edf0d9228/image-20260319-122201.png?cb=8606668873d22ce71a93470bc18e7d03)

## Upload the certificate to Leapwork Go

1. Sign in to the Leapwork Admin Portal.

2. Open the profile section.

3. Use the certificate upload option.

4. Upload `bundle.pem`.

## Validate the generated files

To confirm that generation worked:

* Check that `mitm-cert.pem`, `mitm-key.pem`, `key_pkcs8.pem`, and `bundle.pem` exists in the folder.

* (Optional) Inspect the certificate:

    openssl x509 -in mitm-cert.pem -noout -subject -issuer -dates

## Troubleshooting common issues

### 1. Why do I see "openssl is not found"?

This means OpenSSL is not installed or not available in your system PATH.

**Solution:**

* Install OpenSSL (see [++*Install OpenSSL*++](https://leapwork.atlassian.net/wiki/spaces/PO/pages/4723933198/Create+a+Self-Signed+Certificate+for+Recording+Traffic+in+Leapwork+Performance#Install-OpenSSL-(if-needed))[++section++](https://leapwork.atlassian.net/wiki/spaces/PO/pages/4723933198/Create+a+Self-Signed+Certificate+for+Recording+Traffic+in+Leapwork+Performance#Install-OpenSSL-(if-needed))).

* Open a new terminal or PowerShell window.

* Run `openssl version` to verify installation.

* If the command still fails but OpenSSL is installed, add it temporarily to your PATH:

      $env:PATH = "C:\Program Files\OpenSSL-Win64\bin;" + $env:PATH
      openssl version

  This change applies only to the current session.

### 2. Why is PowerShell blocking the script?

PowerShell may prevent scripts from running due to execution policy restrictions.

**Solution:**

Run the following command before executing the script:

    Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force

Then run the script again.

### 3. Why is `bundle.pem` missing?

This usually means one or more OpenSSL commands failed during execution.

**Solution:**

* Check the console output for errors.

* Ensure OpenSSL is installed and accessible.

* Rerun the script in an empty folder to avoid conflicts.