Skip to content

Trust the HTTPS certificate

Export the certificate Profinity generates and trust it on the computer that runs your AI tool, so the tool accepts an https:// Model Context Protocol (MCP) address. Skip this page when you use the HTTP address on the same computer as Profinity.

Accepting the certificate warning in a browser trusts the certificate in that browser only. Another application, such as an AI tool, needs the certificate trusted in the operating system, or given to it as a file. The guides for Claude Code, Codex, and Cursor give the steps for each tool. Claude Code needs an extra step on some installs. Refer to Connect Claude Code to Profinity for it.

Before you begin

You need:

  • An HTTPS address for the MCP server, from Choose the MCP server address.
  • An edition with the AI licensed feature, which the Server and Enterprise editions include, because the MCP server is part of that licensed feature. Refer to Licensing.
  • Access to the computer that runs the AI tool, where you follow every step on this page.
  • When Profinity runs on another computer, a copy of profinity_generated.pfx from its certificates folder, made with a method you trust, such as a USB drive or scp.
  • When Profinity runs as a Windows service on this computer, read access to the certificates folder of the account the service runs under. Run Profinity as a Windows service describes where that folder is.
  • The openssl command on macOS or Linux, and PowerShell on Windows.
  • Administrator rights (sudo) on Linux, for step 3, and for step 1 when only the account that runs Profinity can read profinity_generated.pfx.

The certificate Profinity generates

When Cert file and Windows cert store are empty, Profinity creates its own certificate the first time HTTPS starts. The certificate file is profinity_generated.pfx in the certificates folder of the artefacts directory, and it has no password.

Profinity also creates this file in place of a Cert file that is missing, cannot be read, or has a wrong password. When you set Cert file and still find profinity_generated.pfx in the folder, Profinity could not use your file. Confirm the path in Cert file and the value in Cert file password, as described in HTTPS certificates.

The certificate names localhost, the computer's host name, 127.0.0.1, ::1, and the address of each network interface that was up when Profinity created it. The host in the MCP address has to be one of these names. An address with any other name gets a certificate error, even when the operating system trusts the certificate.

The default certificates folder depends on how Profinity is installed:

System Default certificates folder
macOS $HOME/Library/Application Support/Prohelion/Profinity/certificates
Linux /var/lib/prohelion/profinity/certificates
Windows desktop $env:LOCALAPPDATA\Prohelion\Profinity\certificates
Windows service $env:LOCALAPPDATA\Prohelion\Profinity\certificates for the account the service runs under, as described in Run Profinity as a Windows service
Docker, with the published compose file $HOME/Prohelion/certificates on the host, which is /app/Prohelion/certificates in the container
Docker, with the one-line installer $HOME/profinity-docker/data/certificates, or data/certificates in the folder you gave with --dir

When PROFINITY_HOME is set, the folder is certificates under that path instead, as described in Artefacts directory. To set up a certificate you supply yourself, refer to HTTPS certificates.

Export and trust the certificate

The file holds a private key with no password

Anyone who has a copy of profinity_generated.pfx can impersonate the Profinity server.

These steps use the certificate Profinity generates. For a certificate you supplied, export it as described in Export a certificate you supplied, then continue from step 3.

Follow these steps on the computer that runs the AI tool:

  1. Export the public certificate for your operating system. Replace <certificates-folder> in the command with the folder in The certificate Profinity generates, or with the folder that holds your copy of the file.

    Run this command in a terminal:

    openssl pkcs12 -in "<certificates-folder>/profinity_generated.pfx" -nokeys -clcerts -passin pass: | openssl x509 -out "$HOME/profinity.pem"

    The command writes only the public certificate to profinity.pem in your home folder. Write $HOME in the path, as the table does, because ~ does not expand inside quotes. When only the account that runs Profinity can read the file, as on a Linux service, put sudo before the first openssl.

    Run these commands in PowerShell:

    $certificate = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new("<certificates-folder>\profinity_generated.pfx")
Export-Certificate -Cert $certificate -FilePath "$env:USERPROFILE\Desktop\profinity.cer"

    The command writes only the public certificate to profinity.cer in the Desktop folder of your user profile, $env:USERPROFILE\Desktop.

  2. If you copied profinity_generated.pfx from another computer, delete that copy.

  3. Trust the exported certificate in your operating system, using that system's own documentation.

  4. Quit the AI tool if it is open.

  5. Start the AI tool. The AI tool now uses the trusted certificate.

Export a certificate you supplied

When Cert file names your own certificate in a .pfx or .p12 file with a Cert file password, export the public certificate from that file in place of step 1. Then follow steps 3 to 5 of Export and trust the certificate.

Run this command in a terminal:

openssl pkcs12 -in "<path-to-your-certificate-file>" -nokeys -clcerts -passin pass:<password> | openssl x509 -out "$HOME/profinity.pem"

Replace <password> with the Cert file password. The command writes only the public certificate to profinity.pem in your home folder.

Run these commands in PowerShell, and enter the Cert file password when PowerShell asks for it:

$certificate = Get-PfxCertificate -FilePath "<path-to-your-certificate-file>" -Password (Read-Host -AsSecureString "Certificate file password")
Export-Certificate -Cert $certificate -FilePath "$env:USERPROFILE\Desktop\profinity.cer"

PowerShell lists profinity.cer on the desktop, which holds the public certificate only.

Replace <path-to-your-certificate-file> with the full path of the file that Cert file names.

Check it worked

From the computer that runs the AI tool, run the check for your operating system:

/usr/bin/curl -s -o /dev/null -w "%{http_code}\n" -X POST -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" -d "{}" "<https-address>"

The curl in /usr/bin checks the certificates the operating system trusts, and a curl from another source can keep its own list.

curl.exe -s -o NUL -w "%{http_code}\n" -X POST -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" -d "{}" "<https-address>"

Replace <https-address> with the HTTPS address of the MCP server, from Choose the MCP server address. For the check on the HTTP address, refer to Check the server answers.

The command prints 401 and no certificate error. A 401 means the server answered and wants a token, so the certificate was accepted.

Fix a certificate error

What you see Cause What to do
The AI tool still reports a certificate error after step 3 The tool was open when the operating system began to trust the certificate Quit the tool, start it again, and repeat the check in Check it worked
The check still reports a certificate error after step 3 The operating system did not trust the certificate Repeat step 3
The certificate error names a different host name or address The address uses a name missing from the certificate, or the certificate was created before the host name or address changed Use a name from The certificate Profinity generates, or create a new certificate
The certificate error says that no name matches, even for localhost The certificate came from an older installation and names no host Create a new certificate
The openssl command prints an error, or profinity.pem is empty The path is wrong, or the file has a password Check the folder against the table in The certificate Profinity generates, and for a file with a password use the command in Export a certificate you supplied
PowerShell reports an error when it opens the file The path is wrong, or the file has a password Check the folder against the table in The certificate Profinity generates, and for a file with a password use the commands in Export a certificate you supplied

For other errors, refer to MCP connection errors.

Create a new certificate after a host name or address changes

Profinity creates the certificate once and keeps it, and the certificate lists the host names and addresses present at that time. A new host name or network address therefore needs a new certificate. The certificate is valid for five years, so note its expiry date and create a new one before then. On Linux, openssl x509 -in "$HOME/profinity.pem" -noout -enddate prints the date, and on macOS and Windows the certificate details show it.

Stop and start Profinity in the way that suits your installation:

Installation Stop and start
Windows desktop Shut down the application, and start it from the Start menu, as described in Install Profinity on Windows
Windows service Stop and start the service as you stop and start any other service on Windows. Refer to Run Profinity as a Windows service
Linux service Run sudo systemctl stop profinity.service, and start it with sudo systemctl start profinity.service. Refer to Run Profinity as a Linux service
macOS service Stop and start the service as you stop and start any other service on macOS. Refer to Run Profinity as a macOS service
Docker Run docker compose stop and docker compose start in the folder that holds the compose file. Refer to Start and stop Profinity

Profinity creates a new certificate when the file is missing. To keep the old certificate, copy it in step 2, before you delete it:

  1. Stop Profinity.
  2. Optional: copy profinity_generated.pfx from the certificates folder to another folder.
  3. Delete profinity_generated.pfx from the certificates folder.
  4. Start Profinity. Profinity creates a new profinity_generated.pfx, with a new key, for the host name and addresses it finds as HTTPS starts.
  5. On the computer that runs the AI tool, repeat steps 1 to 5 of Export and trust the certificate. When two certificates named Profinity are listed, choose the one with the later expiry date, which is the new one. The check in Check it worked prints 401 with the new address.

Once the new certificate is trusted, you can remove the old one, which has the earlier expiry date, from the operating system.

Next, connect your tool: