Introduction
A Certificate Signing Request (CSR) is an important part of the process of obtaining an SSL certificate for your website. It is a block of encoded text that is submitted to a Certificate Authority (CA) when applying for an SSL certificate. The CSR contains information about your organization and domain name, your public key, and your contact details. Generating a CSR with OpenSSL is a straightforward process that can be completed in a few simple steps. In this guide, we will explain how to generate a CSR with OpenSSL.
How to Generate a Certificate Signing Request (CSR) With OpenSSL
1. Open a command prompt window and navigate to the directory where you have installed OpenSSL.
2. Type the following command to generate a private key and CSR:
openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr
3. Enter the required information. You will be asked to provide the following information:
• Country Name (2 letter code)
• State or Province Name (full name)
• Locality Name (eg, city)
• Organization Name (eg, company)
• Organizational Unit Name (eg, section)
• Common Name (eg, your name or your server’s hostname)
• Email Address
4. Once you have entered all the required information, the CSR and private key will be generated.
5. The CSR will be saved in the same directory as the private key, with the filename yourdomain.csr.
Introduction
A Certificate Signing Request (CSR) is the first step in setting up an SSL Certificate on your website. SSL certificates are provided by Certificate Authorities (CA), which require a Certificate Signing Request (CSR).
This guide will instruct you on how to generate a Certificate Signing Request using OpenSSL.
Prerequisites
- Access to a user account with root or sudo privileges
- A command line/terminal window
- If you’re working on a remote server, an established SSH connection to the server
- OpenSSL needs to be installed on your system to generate the key
- A text editor, such as nano, to view your key
Generate a OpenSSL Certificate Signing Request
Step 1: Log Into Your Server
Open a terminal window. Use your SSH connection to log into your remote server.
Note: If you are working locally, you don’t need an SSH connection. Also, most Linux systems will launch a terminal window by pressing Ctrl-Alt-T or Ctrl-Alt-F1.
Step 2: Create an RSA Private Key and CSR
It is advised to issue a new private key each time you generate a CSR. Hence, the steps below instruct on how to generate both the private key and the CSR.
openssl req -new -newkey rsa:2048 -nodes -keyout your_domain.key -out your_domain.csrMake sure to replace your_domain with the actual domain you’re generating a CSR for.
The commands are broken out as follows:
- openssl – activates the OpenSSL software
- req – indicates that we want a CSR
- –new –newkey – generate a new key
- rsa:2048 – generate a 2048-bit RSA mathematical key
- –nodes – no DES, meaning do not encrypt the private key in a PKCS#12 file
- –keyout – indicates the domain you’re generating a key for
- –out – specifies the name of the file your CSR will be saved as
Note: Use 2048-bit key pairs. The 4096-bit key pairs are more secure, however, they require a lot more server resources.
Step 3: Enter Your CSR Information
Your system should launch a text-based questionnaire for you to fill out.
Enter your information in the fields as follows:
- Country Name – use a 2-letter country code (US for the United States)
- State – the state in which the domain owner is incorporated
- Locality – the city in which the domain owner is incorporated
- Organization name – the legal entity that owns the domain
- Organizational unit name – the name of the department or group in your organization that deals with certificates
- Common name – typically the fully qualified domain name (FQDN), i.e. what the users type in a web browser to navigate to your website
- Email address – the webmaster’s email address
- Challenge password – an optional password for your key pair
Please take into account that Organization Name and Unit Name must not contain the following characters:
< > ~ ! @ # $ % ^ * / \ ( ) ? . , &
Step 4: Locate Certificate Signing Request File
Once the software finishes, you should be able to find the CSR file in your working directory.
You can also enter the following:
ls *.csrThe system should list out all certificate signing requests on the system. The one that matches the domain name you provided in Step 2 appended with the .csr extension is the one you need to look into.
Step 5: Submit the CSR as Part of Your SSL Request
You can open the .csr file in a text editor to find the alphanumeric code that was generated.
Enter the following command:
sudo nano your_domain.csrThis text can be copied and pasted into a submittal form to request your SSL certificate from a Certificate Authority.
Make sure you copy the entire text. Some CAs may allow you to simply upload the .csr file you generated. Below is an example of a CSR.
You needn’t send the private key to the CA. Once you get your SSL certificate, the private key on the server will bind with it to encrypt communication.
Conclusion
Now you know how to generate an OpenSSL certificate signing request. Before submitting the CSR to a certificate authority, we recommend verifying the information it holds. Use one of the widely available online CSR decoders.
SSL is a crucial protocol for securing traffic between a website and its visitors. It helps to protect sensitive information online, such as credit card data.
How to Generate a Certificate Signing Request (CSR) With OpenSSL
A Certificate Signing Request (CSR) is a block of encoded text that is submitted to a Certificate Authority (CA) when applying for an SSL Certificate. It contains information that will be included in the certificate such as the organization name, common name (domain name), locality, and country. The CSR also contains the public key that will be included in the certificate. In order to generate a CSR, you will need to create a key pair for your server. The public key and private key make up a key pair.
Steps to Generate a CSR With OpenSSL
- Generate a Private Key:
Open a command prompt and run the following command:
openssl genrsa -out domain.key 2048
This will generate a 2048-bit RSA private key and save it to the file domain.key.
- Generate a CSR:
Run the following command to generate a CSR:
openssl req -new -key domain.key -out domain.csr
This will generate a CSR and save it to the file domain.csr. You will be prompted to enter the following information:
- Country Name (2 letter code)
- State or Province Name (full name)
- Locality Name (eg, city)
- Organization Name (eg, company)
- Organizational Unit Name (eg, section)
- Common Name (eg, your name or your server’s hostname)
- Email Address
- Submit the CSR:
Once you have generated the CSR, you can submit it to the Certificate Authority (CA) of your choice. The CA will then generate a certificate for you based on the information in the CSR.
Conclusion
Generating a Certificate Signing Request (CSR) with OpenSSL is a relatively simple process. All you need to do is generate a private key, generate a CSR, and submit the CSR to the Certificate Authority. Once the CA has generated the certificate, you can install it on your server.
