---
schema_version: "1"
id: 7b1d3bfb939b41194067ade8450e4192816f1ab466014c192b065cc0e085e3aa
title: Add Certificates to a Dedicated Load Balancer
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/cloudhub/lb-cert-upload.md
canonical_url: https://docs.mulesoft.com/cloudhub/lb-cert-upload
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 530dc56b7d73b42de982cc1da9a6ab3ea2f8c8ef59c04f29058d263d2ae4bd5d
description: MuleSoft Documentation Site
latest: true
---
---
product: CloudHub
---

# Add Certificates to a Dedicated Load Balancer

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

When you create a dedicated load balancer (DLB), you must add at least one certificate. You can add
additional certificates to a DLB using Runtime Manager or the command-line interface.

The certificate must be contained in one unencrypted, PEM-encoded file. If you are migrating a
certificate created with Windows tools:

- Remove all "Bag Attributes" and "Key Attributes".

- Convert all end-of-line characters from `\r\n` to `\n`, if necessary.

This file must contain the entire certificate chain ordered sequentially:

<table><colgroup><col> <col></colgroup><thead><tr><th>Certificate</th><th>Example</th></tr></thead><tbody><tr><td><div><div><p>The Primary Certificate</p></div></div></td><td><div><div><p>-----BEGIN CERTIFICATE-----<br>(Your Primary SSL certificate: your_domain_name.crt)<br>-----END CERTIFICATE-----</p></div></div></td></tr><tr><td><div><div><p>The Intermediate Certificate</p></div></div></td><td><div><div><p>-----BEGIN CERTIFICATE-----<br>(Your Intermediate certificate: DigiCertCA.crt)<br>-----END CERTIFICATE-----</p></div></div></td></tr></tbody></table>

You don’t need to include the root certificate in the certificate chain. However, ensure that you
include the ASCII armor in each certificate.

## Add a Certificate to an Existing Load Balancer

You can add a certificate to an existing DLB using Runtime Manager or the command-line interface.

To add a certificate using Runtime Manager:

1.  From Anypoint Platform, click **Runtime Manager**.

2.  Click **Load Balancers**, and then click the load balancer name.

3.  In the **Certificates** tab, click **Add certificate**.

    ![Add certificate option in the load balancer settings page](/mulesoft/current/en-us/cloudhub/_images/lb-cert-upload-update.png)

    Figure 1. The arrow shows the **Add certificate** option in the **Certificates** tab.

4.  Select **Choose File** to upload the public key and private key files, such as:

    - Public key file

      A PEM file that includes both the server certificate and the intermediate CA certificate, for
      example, `example-com-crt.pem`

    - Private key file

      A PEM file that contains a passphrase-less private key, for example,
      `example-com-private-noencrypt.pem`

      To create the passphrase-less file, run a command like the following:

      ```console
      openssl rsa -in example-com-private.pem -out example-com-private_noencrypt.pem
      ```

5.  Click **Save Certificate**.

To add a certificate to an existing DLB using the CLI:

```console
cloudhub load-balancer ssl-endpoint add myLB_name example-com-crt.pem example-com-private.pem
```

## Replace a Certificate on an Existing Load Balancer

You can replace a certificate on an existing DLB when the certificate is expiring or needs to be
updated.

To replace a certificate using Runtime Manager:

1.  From Anypoint Platform, click **Runtime Manager**.

2.  Click **Load Balancers**, and then click the load balancer name.

3.  In the **Certificates** tab, click the certificate name.

4.  Select **Choose File** to upload the public key and private key files, such as:

    - Public key file

      A PEM file that includes both the server certificate and the intermediate CA certificate, for
      example, `new-example-com-crt.pem`

    - Private key file:

      A PEM file that contains a passphrase-less private key, for example,
      `new-example-com-private-noencrypt.pem`

      To create the passphrase-less file, run a command like the following:

      ```console
      openssl rsa -in new-example-com-private.pem -out new-example-com-private_noencrypt.pem
      ```

5.  Click **Done Editing**.

6.  Click **Apply Changes**.

## See Also

- [Configure SSL Endpoints](https://docs.mulesoft.com/cloudhub/lb-ssl-endpoints)

- [Create a Load Balancer with Runtime Manager](https://docs.mulesoft.com/cloudhub/lb-create-arm)

- [Create a Load Balancer with the Anypoint Platform CLI](https://docs.mulesoft.com/cloudhub/lb-create-cli)

- [cloudhub load-balancer ssl-endpoint add](https://docs.mulesoft.com/cloudhub/cloudhub-cli#cloudhub-load-balancer-ssl-endpoint-add)