> For the complete documentation index, see [llms.txt](https://docs.patchmypc.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.patchmypc.com/patch-my-pc-publisher/manage/wsus-updates-tab/wsus-options/certificate-management/manage-certificates/create-self-signed.md).
# Create a Self-Signed Certificate in Patch My PC Publisher
*Applies to: Patch My PC Publisher V3.x*
The **Create Self-Signed** certificate option allows Patch My PC (PMPC) Publisher to create a code-signing certificate.
This option is commonly used when you do not want Microsoft ConfigMgr to manage the certificate, or in standalone WSUS environments where self-signed certificates are permitted and a Certificate Authority is not available.
## To create a self-signed code-signing certificate
1. Load Publisher.
2. Navigate to **WSUS Updates | WSUS Options**.
3. Under the **Manage certificate** section, click **Create Self-Signed**.
{% hint style="info" %}
**Note**
If Publisher detects an existing valid certificate, the **Overwrite Current Certificate** dialog is displayed, warning you and prompting you to click **Yes** to overwrite the existing certificate with the new one. This helps prevent you from accidentally replacing an active and trusted signing certificate.
{% endhint %}
4. On the **WSUS Code Signing Certificate** screen, review and adjust the certificate options as required:
1. **Subject** (Default: **PatchMyPC Service**)
2. **Valid for** (Default: **5 years**)
3. **Key length** (Default: 2048 **bits**)
5. Optionally, leave the **Disable Private Key Export** checkbox unchecked if you may need to move Publisher to another top-level Software Update Point (SUP) in the future and want to take the same code-signing certificate to the new server.
6. Click the **Generate** button.
7. If the certificate is created successfully, the **Certificate Created Successfully** dialog is shown, which you can close by clicking **OK.**
The **SIGNING CERTIFICATE** section updates to show the certificate is valid and its expiry date.
{% hint style="info" %}
**Note**
By default, the generated certificate’s **private key is marked as exportable**. This is intentional and recommended, as it allows the certificate (including the private key) to be exported and reused if the Publisher is later moved to a new top-level SUP. Without an exportable private key, the same signing certificate could not be transferred to another server.
{% endhint %}
After generation, the self-signed certificate is automatically placed in the following **Local Machine** certificate stores on the server:
* **WSUS**\
Used by Publisher, through the WSUS API, to sign third-party updates.
* **Trusted Publishers**\
Allows the operating system to trust updates signed with this certificate.
* **Trusted Root Certification Authorities**\
Required because the certificate is **self-signed** and does not chain back to a trusted Certificate Authority.
{% hint style="danger" %}
**Important**
As self-signed certificates do not have a parent Certificate Authority, they must be explicitly trusted to establish a valid trust chain. For environments using ConfigMgr or WSUS, this means the certificate must be trusted not only on the WSUS server, but also on **all devices that will install updates signed with the certificate**.
As a result, the self-signed certificate must be placed in the **Trusted Publishers** store (to allow installation of signed updates) and the **Trusted Root Certification Authorities** store (to establish trust for the signing certificate) on those devices.
When third-party updates are enabled for the SUP and in Client Settings, ConfigMgr can automatically distribute the signing certificate to managed devices, place it into the required certificate stores, and configure the necessary local Windows Update policies so the Windows Update Agent trusts that signing certificate.
This ensures client devices trust updates signed by a third-party code-signing certificate, rather than only updates signed by Microsoft, without requiring manual certificate deployment. See [ConfigMgr Client Setting Requirements](/patch-my-pc-publisher/requirements/configmgr-requirements/client-settings.md) for more information.
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.patchmypc.com/patch-my-pc-publisher/manage/wsus-updates-tab/wsus-options/certificate-management/manage-certificates/create-self-signed.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
