This article explains how to generate a self-signed certificate bundle that Leapwork Go can use to record HTTPS traffic. The scripts mirror the bundled Leapwork Go Recorder certificate workflow and generate the PEM files required for upload.

This is only required if you choose to use your own self-signed certificate instead of the default certificate provided by Leapwork.

After generating a new certificate and uploading it to the Admin Portal, it must be added to the Trusted Root Certification Authorities store on all user machines. If this step is not completed, recording functionality will not work as expected.

## Before you start

Make sure:

- OpenSSL is installed and available in your terminal or PowerShell session.
- You use an empty folder so the generated files are easy to find.

## Install OpenSSL (if needed)

### Windows

- Download and install OpenSSL for Windows from Shining Light Productions:

[https://slproweb.com/products/Win32OpenSSL.html](https://slproweb.com/products/Win32OpenSSL.html)
- After installation, open a new PowerShell window and run:

```text

```

### macOS

If OpenSSL is not already available:

Install Homebrew:

```text

```

Install OpenSSL:

```text

```

Verify:

```text

```

## Generate the certificate on macOS

Use this script on macOS to create the certificate and key files that Leapwork Go needs for HTTPS traffic recording.

1. Save the script below as `generate-leapGo-certificate.sh` in an empty folder.

```text
   
   ```

2. Replace `<Your organization name>` and `<Leapwork Go Recorder CA>` if needed.
3. Run:

```text

```

## Generate the certificate on Windows

1. Open PowerShell.
2. Save the script below as `Generate-LeapGo.ps1` in an empty folder.

```text
   
   ```

3. In the script, replace `Your organization name` with your company name.
4. Keep `Leapwork Go Recorder CA` as the certificate name, or replace it with your preferred common name.
5. Run:

```text

```

## Files generated

The scripts generate these files:

- `mitm-cert.pem`: public certificate in PEM format.
- `mitm-key.pem`: private key in PEM format.
- `key_pkcs8.pem`: private key converted to PKCS#8 PEM format.
- `bundle.pem`: combined PEM file that includes `mitm-cert.pem` and `key_pkcs8.pem` for upload.

Keep `mitm-key.pem`, `key_pkcs8.pem`, and `bundle.pem` secure.

## Upload the certificate to Leapwork Go

1. Sign in to the Leapwork Admin Portal.
2. Open the profile section.
3. Use the certificate upload option.
4. Upload `bundle.pem`.

## Validate the generated files

To confirm that generation worked:

- Check that `mitm-cert.pem`, `mitm-key.pem`, `key_pkcs8.pem`, and `bundle.pem` exists in the folder.
- (Optional) Inspect the certificate:

```text

```

## Troubleshooting common issues

### 1. Why do I see “openssl is not found”?

This means OpenSSL is not installed or not available in your system PATH.

**Solution:**

- Install OpenSSL (see [_Install OpenSSL_](https://leapwork.atlassian.net/wiki/spaces/PO/pages/4723933198/Create+a+Self-Signed+Certificate+for+Recording+Traffic+in+Leapwork+Performance#Install-OpenSSL-(if-needed)) [section](https://leapwork.atlassian.net/wiki/spaces/PO/pages/4723933198/Create+a+Self-Signed+Certificate+for+Recording+Traffic+in+Leapwork+Performance#Install-OpenSSL-(if-needed))).
- Open a new terminal or PowerShell window.
- Run `openssl version` to verify installation.
- If the command still fails but OpenSSL is installed, add it temporarily to your PATH:

```text

```

This change applies only to the current session.

### 2. Why is PowerShell blocking the script?

PowerShell may prevent scripts from running due to execution policy restrictions.

**Solution:**

Run the following command before executing the script:

```text

```

Then run the script again.

### 3. Why is `bundle.pem` missing?

This usually means one or more OpenSSL commands failed during execution.

**Solution:**

- Check the console output for errors.
- Ensure OpenSSL is installed and accessible.
- Rerun the script in an empty folder to avoid conflicts.