How to create Certificate Signing Request with OpenSSL. Below is the command used to create the private key named alex2048opensslprivateKey.key, CSR named alex2048opensslcertificate.crt and both of RSA 2048 bit strengh with SHA256 signing algorithm that would last 731 days and with the password of sterling.
Generate CSR - OpenSSL
Generate a Private Key Generate a new Private Key with OpenSSL command line utility. openssl genrsa -out privkey.pem 2048 There is now a file in your current directory called privkey.pem (save and keep this Safe) Note: The last argument in this command is the key size values less then 2048 are considered insecure and therefore not commonly used. During SSL setup, if you’re on a Windows-based system, there may be times when you need to generate your Certificate Signing Request (CSR) and Private key outside the Windows keystore. This may be useful, for example, if you want to backup your SSL Certificate.
This article provides step-by-step instructions for generating a Certificate Signing Request (CSR) in OpenSSL. This is most commonly required for web servers such as Apache HTTP Server and NGINX. If this is not the solution you are looking for, please search for your solution in the search bar above.
Switch to a working directory
GNU/Linux & Mac OS X users:
Open a terminal and browse to a folder where you would like to generate your keypair
Navigate to your OpenSSL 'bin' directory and open a command prompt in the same location.
Generate a CSR & Private Key:
openssl req -out CSR.csr -new -newkey rsa:2048 -keyout privatekey.key
To generate a 4096-bit CSR you can replace the rsa:2048 syntax with rsa:4096 as shown below.
openssl req -out CSR.csr -new -newkey rsa:4096 -keyout privatekey.key
Note: You will be prompted to enter a password in order to proceed. Keep this password as you will need it to use the Certificate.
Fill out the following fields as prompted:
Note: The following characters can not be accepted: < > ~ ! @ # $ % ^ * / ( ) ?.,&
|Country Name||US (2 Letter Code)|
|State or Province||New Hampshire (Full State Name)|
|Locality||Portsmouth (Full City name)|
|Organization||GMO GlobalSign Inc (Entity's Legal Name)|
|Organizational Unit||Support (Optional, e.g. a department)|
|Common Name||www.globalsign.com (Domain or Entity name)|
You should now have a Private Key (privatekey.key) which should stay on your computer, and a Certificate Signing Request (CSR.csr), which can be submitted to GlobalSign to sign your public key. Each of these files can be viewed in a plain text editor such as Notepad, TextEdit, Vi, Nano, and Notepad++.
OpenSSL CSR Wizard
Our OpenSSL CSR Wizard is the fastest way to create your CSR for Apache (or any platform) using OpenSSL.
Fill in the details, click Generate, then paste your customized OpenSSL CSR command in to your terminal.
Note: After 2015, certificates for internal names will no longer be trusted.
Common Name (Server Name)
The fully qualified domain name that clients will use to reach your server.
For example, to secure https://www.example.com, your common name must be www.example.com
or *.example.com for a wildcard certificate.
Although less common, you may also enter the
public IP address of your server.
You can leave this field blank. This is the
department within your organization that you want
to appear on the certificate. It will be listed in the certificate's subject as Organizational Unit, or 'OU'.
Common examples: Web Administration,
Web Security, or Marketing
The city where your organization is legally located.
State or Province
The state or province where your organization is legally located.
We guessed your country based on your IP address, but if we guessed wrong, please choose the correct country. If your country does not appear in this list, there is a chance we cannot issue certificates to organizations in your country.
The exact legal name of your organization, (e.g., DigiCert, Inc.)
If you do not have a legal registered organization name, you should enter your own full name here.
RSA Key sizes smaller than 2048 are considered unsecure.
Now just copy and paste this command into a terminal session on your server. Your CSR will be written to ###FILE###.csr.
After you've created a Certificate Signing Request (CSR) and ordered your certificate, you still need to install the SSL certificate on your server.
For instructions on how to install SSL certificates, see SSL Certificate Installation Instructions & Tutorials.
Where do I paste this command?
You can run this command wherever you have OpenSSL available—most likely on your server, but you can also run it on your own computer since macOS comes with OpenSSL installed. Just make sure you keep track of your private key file after you create your CSR; you'll need that private key to install your certificate.
What happens when I run this command?
OpenSSL creates both your private key and your certificate signing request, and saves them to two files: your_common_name.key, and your_common_name.csr. You can then copy the contents of the CSR file and paste it into the CSR text box in our order form.
What kind of certificate should I buy?
If you want an SSL certificate for Apache, your best options are Standard certificates and Wildcard certificates.
A DigiCert Wildcard can protect all server names on your domain (e.g., *.example.com,). Our unlimited server license lets you protect all your servers for just one price. Many of our customers save thousands of dollars per year by using a DigiCert Wildcard certificate.
|Per Year Pricing|
|2 Years||$653 per year||($1,307)||(You Save 10%)|
Standard certificates are able to protect one server name (e.g., mail.example.com). If you only need SSL for one hostname, a Standard certificate will work perfectly.
|Per Year Pricing|
|2 Years||$207 per year||($414)||(You Save 10%)|
What If I Need Subject Alternative Names?
Multi-Domain (SAN) certificates allow you to assign multiple host names—known as Subject Alternative Names or SANs—in one certificate.
Using OpenSSL to Add Subject Alternative Names to a CSR is a complicated task. Our advice is to skip the hassle, use your most important server name as the Common Name in the CSR, and then specify the other names during the order process. Our Multi-Domain (SAN) certificate ordering process allows you to specify all the names you need without making you include them in the CSR.
Openssl Generate Rsa Private Key
You can also use OpenSSL to create a certificate request for your code signing certificate.
Si desea información en español a Hacer un CSR Utilizando OpenSSL.
Openssl Certificate Request Windows
- Learn more about what our Wildcard certificate can do for you.
- We also have a similar CSR Tool for Exchange 2007.