---
title: Web Signing Certificates
description: Sign Live Update bundles in Capawesome Cloud by uploading a code-signing certificate. Verify integrity of OTA updates before they reach end users.
---

# Web Signing Certificates

To sign Live Update bundles in Capawesome Cloud, you need to configure a signing certificate. Web apps use a PEM certificate file containing a private key to sign bundles, ensuring the authenticity and integrity of your Live Updates.

!!! tip "AI-Assisted Setup"

    For a more guided experience, add the [Capawesome skills](https://github.com/capawesome-team/skills){:target="_blank"} to your project with `npx skills add capawesome-team/skills --skill capawesome-cloud` and use the following prompt with your preferred AI coding assistant:

    ```
    Use the `capawesome-cloud` skill from `capawesome-team/skills` to help me set up a Web signing certificate in Capawesome Cloud.
    ```

## Configuration

To create a web signing certificate, navigate to the [Signing certificates](https://console.cloud.capawesome.io/apps/_/certificates){:target="_blank"} page in the Capawesome Cloud Console and provide the following information:

- **Name**: A descriptive name for the certificate (e.g., "Production Web Certificate").
- **Platform**: Must be set to `Web`.
- **Type**: The certificate type (`Development` or `Production`).
- **Certificate File**: The PEM file containing the private key. Must have a `.pem` extension.

Read on for detailed instructions on creating and obtaining these credentials.

## Obtaining Credentials

### Name

Choose a descriptive name that helps you identify the certificate's purpose (e.g., "Production Web Certificate", "Development Certificate"). This name is only used within Capawesome Cloud for organization purposes.

### Type

Select the appropriate certificate type:

- **Development**: For development and testing builds that are not distributed publicly.
- **Production**: For release builds that will be distributed to end users.

### Certificate File

A PEM file containing your private key is required to sign Live Update bundles. You can generate a key pair using the Capawesome CLI:

```bash
npx @capawesome/cli apps:liveupdates:generatesigningkey
```

This creates a `private.pem` and `public.pem` file in the current directory. Upload the `private.pem` file as the certificate file in the Capawesome Cloud Console.

You can also customize the output paths and key size:

```bash
npx @capawesome/cli apps:liveupdates:generatesigningkey --private-key /path/to/private.pem --public-key /path/to/public.pem --key-size 4096
```

???+ warning "Keep your private key secure"

    Store your private key in a secure location, add it to your `.gitignore`, and never commit it to version control. If you lose your private key, you will need to generate a new key pair and reconfigure your app.

For more information on code signing, see the [Code Signing](../../live-updates/code-signing.md) guide.