How to Generate a CSR on a MiCollab Server

This tutorial shows you how to generate a CSR on a MiCollab Server. MiCollab runs on Mitel Standard Linux (MSL), so the request is created in the MSL Server Manager, the same web admin you use for backups and licensing. There is nothing to install and nothing to type at a shell: you fill in a form, click a button, and MSL builds a 2048-bit RSA key pair and prints the request on screen.

The steps below match the current MiCollab line (10.3 is the release Mitel points customers to as of July 2026) and are unchanged on the 9.8 and 10.x branches still under support. The panel belongs to MSL rather than to MiCollab itself, so the same procedure applies to MiVoice Border Gateway and other MSL application servers.

Before you start

Four decisions save you a reissue later:

• Generate the CSR on the server that will present the certificate. The private key is written on that machine and stays there, and Mitel’s install procedure begins by telling you to log in to the Server Manager “for the system that was used to generate the CSR”. If MiCollab sits on the LAN behind a MiVoice Border Gateway or Web Proxy on the network edge, remote clients terminate their connection at the gateway, so you generate the CSR on the MBG / Web Proxy and later copy the certificate and key across to the LAN servers. If your MSL servers sit behind a corporate firewall and are reached directly, each one needs its own certificate.
• Order an RSA certificate. The Upload and install a web server certificate option supports only certificates and keys based on the RSA algorithm. An ECDSA certificate is a dead end on this platform: the CSR MSL generates is RSA, and the install screen will not take an EC key. MSL supports SHA-2, so SHA-256 signing is fine, which is what public CAs issue by default.
• Fix the hostname first. Use the fully qualified domain name your users and MiCollab Mobile Client devices actually resolve, not the server’s internal short name. MSL pre-fills the Common Name field with the server’s own FQDN, which is convenient but not always the name clients connect to.
• Check whether you need a CSR at all. The same Web Server Certificate tab can request a free Let’s Encrypt certificate or enroll against an internal Enterprise CA over SCEP, and both of those skip the request and installation entirely. See when you do not need a CSR below.

One thing you will not find is a command-line route. MSL has an underlying Linux shell and a root account, but Mitel documents certificate handling only through the Server Manager, and its own guide warns that making changes and customizations from the Linux command prompt may invalidate the support agreement. Use the web interface.

Generate the CSR on MiCollab Server

If you already generated your CSR and your certificate has been issued, skip this section and go straight to installing the SSL certificate on MiCollab.

Step 1: Open the Web Server Certificate tab

1. Sign in to the MiCollab Server Manager (the MSL Server Manager) with an administrator account.
2. In the left pane, under Security, click Web Server.
3. Click the Web Server Certificate tab.

The top of the tab shows whatever certificate is active right now: issuer, certificate name, alternate names, and the valid-from and expiry dates. Read it before you do anything else. If the issuer names the server itself rather than a Certificate Authority, you are still on the default self-signed certificate that ships with MSL, which is enough to silence a browser warning on a workstation you control but is not enough for MiCollab Mobile Client deployments.

Step 2: Start a new certificate signing request

Below the certificate summary, the tab lists the actions available on this server. Alongside the Let’s Encrypt controls and the Enterprise CA option you will find the third-party certificate actions:

• Generate a new Certificate Signing Request (CSR)
• Upload and install a web server certificate
• Download the current web server certificate
• Uninstall the third-party web server certificate

The uninstall action only appears once a third-party certificate is installed, so on a server still running the default self-signed certificate you will not see it.

Select Generate a new Certificate Signing Request (CSR), then click Perform. If a request was created on this server before, the form comes back pre-filled with the values you used last time, which is handy at renewal and easy to misread as “already done”. Check every field.

Step 3: Fill in the certificate details

Mitel’s own instruction for this form is to capitalize the first letter only, so type Ontario rather than ONTARIO. Here is what belongs in each field:

• Country Name (two letter code): the two-letter ISO code for the country where your organization is legally registered, such as US for the United States or CA for Canada.
• State or Province Name: the full name, not an abbreviation. Washington, not WA.
• Locality Name: the full name of the city or town where the organization is located. Los Angeles, not LA.
• Organization Name: the legally registered name of the company, exactly as it appears in your incorporation records, for example Your Company LLC. For an OV or EV certificate the CA verifies this against a public registry, so a nickname or trading name will stall validation. If you are enrolling as an individual rather than a company, Mitel’s guidance is to put the requester’s name here.
• Organizational Unit Name: the department, such as IT. Whatever you type here will not reach the certificate: since 1 September 2022 the CA/Browser Forum Baseline Requirements have barred public CAs from including the Organizational Unit field in issued certificates. Leave it empty if the form lets you, and do not spend time on it if it insists on a value.
• Common Name: the fully qualified domain name you are securing, for example micollab.yoursite.com. MSL pre-fills the server’s own FQDN. For a wildcard certificate, replace the first label with an asterisk and keep the dot: *.yoursite.com covers micollab.yoursite.com and mbg.yoursite.com but not yoursite.com itself.

Some MSL builds also show an Alternate Name(s) box on this form. Mitel added a Subject Alternative Names field to the Web Server panel in MSL Release 11.0, but its step-by-step procedure was never updated to describe it, so the documentation and the screen do not always agree. If the box is there, list the extra hostnames in it. If it is not, you declare them on the Certificate Authority’s order form instead, which is the route Mitel documents. Either way, see ordering the certificate below.

Step 4: Generate the request and copy it

Re-read the form, then click Generate Certificate Signing Request. MSL creates a fresh 2048-bit RSA key pair (that key length has been the default since MSL Release 9.1.24) and displays the request as a block of Base64 text:

-----BEGIN CERTIFICATE REQUEST-----
MIICtDCCAZwCAQAwbzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCldhc2hpbmd0b24x
EDAOBgNVBAcMB1NlYXR0bGUxGTAXBgNVBAoMEFlvdXIgQ29tcGFueSBMTEMx
... (more lines of Base64) ...
-----END CERTIFICATE REQUEST-----

Select the whole block, including the BEGIN and END lines and the five hyphens on either side of each, and copy it. There is no file to hunt for on your workstation: the request is built on the server and shown to you here, and Mitel’s procedure goes straight from the button to “copy the text of the CSR file” with no save step in between. Where MSL does hand you a file, as the download action on this tab does, it says so.

Do not clean it up. Mitel’s guide is explicit that you must not edit the generated text in an editor such as Notepad, and the reason is arithmetic rather than style: the CSR is signed by the private key, so a single changed, added or removed character invalidates the signature and the CA rejects it. If a detail is wrong, go back and generate the request again instead of correcting the text.

Regenerating is safe while you are still preparing the order. Nothing is installed until you come back to this tab and run Upload and install a web server certificate, so the certificate currently in use keeps serving traffic while you rework the request. It is not safe after you have ordered: a new request means a new private key, and the certificate the CA is about to issue would no longer have a matching key on the server. Once the CSR is with the CA, leave the panel alone until the certificate arrives.

Step 5: Check the CSR before you order

A typo here costs you a full validation round, so read the request back before you pay for anything. Paste it into our CSR Decoder and confirm the Common Name is the hostname clients actually use, the organization details are spelled correctly, and the key size is 2048 bits.

If you would rather check it locally, save the block to a plain-text file, for example micollab.csr, and run OpenSSL on any workstation:

openssl req -noout -text -verify -in micollab.csr

The output opens with a line confirming the request’s own signature verified, then prints the decoded subject and the public key size. If it reports an error instead, the block was copied incompletely or was altered, and you should copy it again from the Server Manager.

Order the certificate with the CSR

Paste the request into the CSR box on your order form. Three choices on that form decide whether the certificate will actually work on MSL.

How many names the certificate has to cover

The MSL request form asks for one Common Name, but a typical MSL estate is several servers on one domain: MiCollab, MiVoice Business, MiCollab Client, Unified Messaging, the Border Gateway. Every hostname a client resolves has to be in the certificate, or that service is refused. You have three ways to get there:

• One name. A single-domain certificate, fine when MiCollab is the only externally reached server.
• Several named hosts. Order a multi-domain certificate and enter each FQDN as a Subject Alternative Name on the CA’s form, for example micollab.yoursite.com, mivb.yoursite.com and micollabclient.yoursite.com. Mitel notes you can also list an IP address as a SAN when users reach an MSL application server directly from the LAN rather than through the gateway, but a publicly trusted CA can only include a routable address it can validate, never a private one such as 10.x or 192.168.x.
• A wildcard. Put *.yoursite.com in the Common Name and one certificate covers every current and future host in that domain. This is the usual answer for a multi-server MSL deployment, since you can share it with the LAN servers without reissuing each time you add one.

Whichever route puts the names in, read them back on the issued certificate before you install it. A missing hostname is invisible until the client that needs it fails to connect.

Which server software to declare

When the order form asks what web server the certificate is for, choose Apache. Mitel states plainly that other options are not supported on the MSL platform. Apache is the setting that gets you separate Base64 (PEM) files, which is what the MSL upload screen expects. Picking a Windows or Java option typically produces a bundled or binary file you would then have to convert. If you end up with the wrong format anyway, OpenSSL converts it. The first command below handles a binary DER certificate, the second a PKCS#7 bundle with a .p7b extension:

openssl x509 -inform der -in cert.der -out cert.pem
openssl pkcs7 -inform der -print_certs -in cert.p7b -out cert.pem

Leave out the -inform der on the second command if the bundle already opens with a BEGIN PKCS7 line, which means it is text rather than binary.

MSL accepts third-party certificates in PEM or PKCS#12 form. PEM files are the Base64 text ones, usually with a .pem, .crt, .cer or .key extension, opening with a BEGIN CERTIFICATE line. PKCS#12, usually .pfx or .p12, is a binary container holding certificate, chain and key together.

Make sure you receive the intermediate certificate

MiCollab needs the intermediate certificate, and Mitel flags it twice, once when you order and again when you install. Without it, MiCollab Mobile Client connections fail and users cannot download their deployment configurations, because the client has no way to build a chain from your certificate up to a trusted root. Download the full package the CA sends you, including the CA bundle, and keep it with the certificate.

If your CA gives you several separate intermediate files and expects you to combine them, do it in an editor that writes Unix line endings. Mitel warns specifically against assembling a bundle in a Windows editor such as Notepad, because the line endings it inserts can break the file.

One thing to plan for at order time: public certificate lifetimes are contracting on a fixed schedule agreed by the CA/Browser Forum. The maximum term dropped to 200 days on 15 March 2026, falls to 100 days on 15 March 2027, and to 47 days on 15 March 2029. On MSL that means the upload procedure comes round more often, so it is worth deciding now whether the automated Let’s Encrypt or SCEP options below fit your deployment better than a manual renewal cycle.

When the certificate arrives, continue with our guide on how to install an SSL certificate on MiCollab Server. Afterwards, confirm the result from outside with our SSL Checker, which reports the chain, the names on the certificate and the expiry date.

When you do not need a CSR

Two options on the same Web Server Certificate tab obtain a certificate without a manual request, and both are worth a look before you start typing into the CSR form.

• Let’s Encrypt. MSL can request a free certificate from Let’s Encrypt, install it, and renew it automatically, with no CSR and no upload step. Enter a contact email address, a Common Name and any alternate names, then click Get Certificate. The conditions are strict: the server has to be reachable from the internet, directly or through a proxy, every FQDN in the request must be publicly resolvable, and a validation request to each name, at https://FQDN/.well-known/acme-challenge/CHALLENGE_TOKEN, has to reach that server and be answered by it. Mitel’s MiCollab guide adds that the request has to arrive on port 80. Wildcards are not available through this route, so a wildcard requirement sends you back to the CSR. The service is also not supported behind a MiVoice Border Gateway Web Proxy older than 9.4. Confirm it fits your own deployment before you count on it, because Mitel’s documentation is inconsistent here: the MiCollab guide publishes the procedure for MiCollab servers, while the Let’s Encrypt section of the MSL guide says the service is not supported on MiCollab Server or MiCollab Virtual Appliance deployments.
• Enterprise CA over SCEP. If your organization runs its own Certificate Authority, select Enterprise CA – SCEP Enrollment and click Perform. You supply the CA address, the URI path, an enrollment password if the CA requires one, a Common Name and any alternate names, then click Get Certificate. MSL builds the request and enrolls for you; the certificate may be issued immediately or sit pending until an administrator on the CA approves it. Reload the Server Manager afterwards for the new certificate to take effect. This only works for internally trusted certificates, so it suits management access and internal clients, not the general public.

MSL also ships a default self-signed certificate. It stops the browser warning on workstations where you install it manually, but it will not carry MiCollab Mobile Client deployments, which is the reason most administrators end up here in the first place.

Frequently Asked Questions