Creating the Supervisor certificate CSR prepares it for signing without its private key.

For the procedure, see Create a CSR for each server certificate.

Signing the Supervisor server certificate is done using the private key of the root certificate.

Importing the signed Supervisor server certificate back into the Key Store changes the caution shield to the green shield.