What is OpenSSL?
OpenSSL is a suite of security tools for Linux, Unix, FreeBSD and OpenBSD distributions. OpenSSL's swiss army knife is the aptly named openssl command-line utility that allows you to manage certificates and generate private keys.
How does openssl work?
The first step to generate a certificate request is to generate your private key to sign the request with. It is this private key that allows the server to be identified. If you don't have a private key yet, which is the case if you're aiming to install a certificate on the server for the first time, private key and certificate request can be generated in a single step.
How to generate a CSR with openssl?Connect to your server using the SSH (Secure Shell) protocol. Windows doesn't have a built-in SSH client, Kinamo recommends you download the free and popular PuTTY
client. If you're working on a Mac OS X or Linux desktop, you simply open a terminal window and type in the following command, taking care to replace the servername with the hostname or IP address of your own server.ssh -l root server.comAfter typing in your password, you'll be connected to the server. SSL certificates, keys and CSR's are usually kept in a single directory on your server, but the exact folder may vary according to your distribution. For illustration purposes, we'll be using /etc/ssl/certs in this article.Go to your certificate directory:[root@server ~]# cd /etc/ssl/certs
[root@server certs]#If you need to generate a private key yet, type the following command at the prompt:[root@server certs]# openssl req -sha256 -nodes -newkey rsa:2048 -keyout www.server.com.key -out www.server.com.csrDo not forget to replace www.server.com with your own server name, unless you happen to be the luck owner of server.com, of course.Alternatively, should you wish to make use of bleeding edge ECC (Ellyptical Curve Cryptography) encryption instead of RSA, execute the following commands, first to generate your ECC private key, then to create a CSR signed by your ECC key:[root@server certs]# openssl ecparam -out www.server.com.key -name prime256v1 -genkey
[root@server certs]# openssl req -new -key www.server.com.key -out www.server.com.csr
If you had a private key from an earlier certificate, which is the case if you want to renew or reissue your certificate, use the following command:[root@server certs]# openssl req -new -sha256 -key www.server.com.key -out www.server.com.csrThere's an even shorter way of generating a certificate request based on an old certificate, if that's what you aim to do:[root@server certs]# openssl x509 -x509toreq -in www.server.com.crt -out www.server.com.csr -signkey www.server.com.keyYou'll be presented with a dialog that asks you to input all relevant information for your certificate request. You should be careful to enter your company information in exactly the same way it is displayed in WHOIS records for your domain name, and that it corresponds with your company data as entered in your country's company registry at incorporation.Generating a 2048 bit RSA private key
writing new private key to 'www.server.com.key'
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [XX]:BE
State or Province Name (full name) :Antwerpen
Locality Name (eg, city) [Default City]:Antwerpen
Organization Name (eg, company) [Default Company Ltd]:Kinamo NV
Organizational Unit Name (eg, section) :
Common Name (eg, your name or your server's hostname) :www.server.com
Email Address :
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password :
An optional company name :
Replace the company data in the above example with yours, and insert the domain name you're requesting a certificate for under Common Name. In case you're requesting a wildcard, the domain name should be *.server.com.You can check whether you entered the correct data in your CSR with the following command:[root@server certs]# openssl req -in www.server.com.csr -noout -text
Version: 0 (0x0)
Subject: C=BE, ST=Antwerpen, L=Antwerpen, O=Kinamo NV, CN=www.server.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Exponent: 65537 (0x10001)
Signature Algorithm: sha256WithRSAEncryption
8e:1c:79:41Print out the contents of the certificate request file to your screen:[root@server certs]# cat www.server.com.csr
-----BEGIN CERTIFICATE REQUEST-----
-----END CERTIFICATE REQUEST-----Copy the full text of the CSR, including the BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST lines and their dashes, and paste the contents into Kinamo's certificate request form.Please note that Kinamo offers you a free tool to generate a CSR without OpenSSL hassle: the Kinamo SSL Generator
. The tool generates your CSR and a corresponding private key for you. Don't forget to save the latter on your server: if you don't, your SSL certificate will be unusable.
rtificaat onbruikbaar zijn.