If you need to generate a CSR (certificate signing request) for your website, you can do so using the OpenSSL command. In this blog post, we will discuss two methods that you can use to create a CSR using OpenSSL. We will also provide instructions on how to use each method. Let’s get started!
Table of Contents
What is CSR?
A CSR is a file that you create to request a certificate from a certificate authority (CA). The CSR contains information about your websites, such as the domain name and contact information. When you submit the CSR to a CA, they will use the information in the file to generate a certificate for your website.
Once you have received the certificate from the CA, you can install it on your web server. A Certificate Signing Request (CSR) is the first step in setting up an SSL Certificate on our website.
Generate CSR with openssl command
When you generate a CSR using OpenSSL, you will need to provide the path to your website’s private key file. A private key is a file that contains a secret key that is used to encrypt data and authenticate messages.
Get Your Free Linux training!
Join our free Linux training and discover the power of open-source technology. Enhance your skills and boost your career! Learn Linux for Free!The private key is used in conjunction with the public key to create a cryptographic key pair. The private key must be kept confidential and should not be shared with anyone. The private key is used to sign the CSR and it must be kept confidential.
We can use the following two commands to generate the private key and CSR.
- openssl genrsa -out privateKey.key 2048
- openssl req -new -key privateKey.key -out CSR.csr
We can also use the following one command to generate both the private key and the CSR using one command. It is advised to issue a new private key each time we generate a CSR.
openssl req -new -newkey rsa:2048 -nodes -keyout your_domain.key -out your_domain.csr
- openssl – activates the OpenSSL software
- req – indicates that we want a CSR
- –new –newkey – generate a new key
- rsa:2048 – generate a 2048-bit RSA mathematical key
- –nodes – no DES, meaning do not encrypt the private key in a PKCS#12 file
- –keyout – indicates the domain we are generating a key for
- –out – specifies the name of the file our CSR will be saved as
Enter our CSR Information
Our system should launch a text-based questionnaire for us to fill out. We will get our CSR file in the current directory.
Enter our information in the fields as follows:
- Country Name – use a 2-letter country code (US for the United States)
- State – the state in which the domain owner is incorporated
- Locality – the city in which the domain owner is incorporated
- Organization name – the legal entity that owns the domain
- Organizational unit name – the name of the department or group in our organization that deals with certificates
- Common name – typically the fully qualified domain name (FQDN), i.e. what the users type in a web browser to navigate to our website
- Email address – the webmaster’s email address
- Challenge password – an optional password for our key pair
We can use this command to skip the interactive input.
openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key -subj "/C=US/ST=Florida/L=Saint Petersburg/O=Your Company, Inc./OU=IT/CN=yourdomain.com"
CSR file format
CSR file is a common plain-text file. We can use more or cat commands in Linux to check the content of the CSR file.
The file would start with “—–BEGIN CERTIFICATE REQUEST—–” and end with “—–END CERTIFICATE REQUEST—–“.
—–BEGIN CERTIFICATE REQUEST—–
MIICtzCCAZ8CAQAwcjELMAkGA1UEBhMCVVMxEzARBgN
9B1GUelQ014/wdOAOYHe1AnHNZLoK7N2C7coxtqKUM
NY/C7m5efjEN9+QwWNfIkVV+Gd3iYTkvUdB+IeXdSfYjZ
MuI2cv6rIsaXB9iq7jx6w3xALTSrHudNkGg8
—–END CERTIFICATE REQUEST—–
Verifying CSR Information with openssl
After creating our CSR using our private key, we recommend verifying that the information contained in the CSR is correct and that the file hasn’t been modified or corrupted.
Use the following command to view the information in our CSR before submitting it to a CA.
openssl req -text -in your_domain.csr -noout -verify
The -noout switch omits the output of the encoded version of the CSR. The -verify switch checks the signature of the file to make sure it hasn’t been modified.
Submit the CSR to Certificate Authorities
We can open the .csr file in a text editor to find the alphanumeric code that was generated.
This text can be copied and pasted into a submittal form to request our SSL certificate from a Certificate Authority. Make sure we copy the entire text.
Related:
OpenSSL Command to Generate View Check Certificate