- generate a signing request on the system where oVirt Manager is running (the engine server)
openssl req -new -sha256 -key /etc/pki/ovirt-engine/keys/apache.key.nopass -out /tmp/engine.csr
- Submit the CSR to the issuer and wait. Or, if you are the issuer and you happen to be using FreeIPA/IdM, you may issue the certificate with ipa-admintools. For example,