How to Generate a Certificate Signing Request (CSR) With OpenSSL

Introduction

A certificate signing request (CSR) is the first step in setting up an SSL certificate on your website. SSL certificates are provided by certificate authorities (CAs), which require a certificate signing request (CSR).

This guide will tell you how to generate a certificate signing request using OpenSSL.

Prerequisites

• Access a user account with root or sudo privileges

A

• command line/terminal window

If you are working on a remote server, it is necessary to install an

• SSH connection established with

the OpenSSL server

• on the system to generate the

key

• A text editor, such as nano, to view your key

Generate an OpenSSL

certificate signing request Step 1: Log in to your server

Open a terminal window. Use your SSH connection to log in to your remote server.

Step 2: Create an RSA private key and

CSR

It is recommended that you issue a new private key each time you generate a CSR. Therefore, the steps below instruct on how to generate both the private key and the CSR.

openssl req -new -newkey rsa:2048 -nodes -keyout your_domain.key -out your_domain.csr

Be sure to replace your_domain with the actual domain for which you are generating

a CSR.

The commands are broken down as follows

:

• openssl – activates the OpenSSL software requirement

– indicates that

• we want a CSR-new -newkey – generate a new rsa:2048 key – generate a 2048-bit RSA math key – no DES, which means that you do not encrypt the private key in a PKCS#12 file key –

indicates the domain for which

• is generating a key

–

• specifies the name of the file that your CSR will be saved as Step 3: Enter your CSR information Your system must launch a text-based questionnaire for you to complete. Enter your information in the fields as follows: Country name: Use a 2-letter

• country code (U.S. for U.S.)

State: The state in which the domain owner joins Location: The

• city in which the domain owner joins

Organization Name

• : The legal entity that owns the domain
• Organizational Unit Name

– the name of the department or group in your organization that deals with certificates

• Common name – typically the fully qualified domain name (FQDN), that is, what users type in a web browser to navigate to your website

Email address: the

• webmaster’semail address
• Challenge password: an optional password for your key pair

Note that the organization name and drive name must not contain the following characters

:

< > ~ ! @ # $ % ^ * / ( ) ? .

, and

Step 4: Locate

the certificate signing request file

Once the software finishes, you should be able to find the CSR file in your working directory

.

You can also enter the following:

ls *.csr

The system must list all certificate signing requests in the system. The one that matches the domain name you provided in Step 2 appended with the extension .csr is the one you should investigate.

Step 5: Submit the CSR as part

of your SSL request You can open the .csr file in a text editor to

find the alphanumeric code that was generated

.

Type the following command:

sudo nano your_domain.csr

This text can be copied and pasted into a submission form to request your SSL certificate from a certificate authority

.

Be sure to copy the entire text. Some CAs may allow you to simply upload the .csr file you generated. Below is an example of a CSR.

You do not need to send the private key to the CA. Once you get your SSL certificate, the private key on the server will be linked to it to encrypt the communication.

Conclusion

Now you know how to generate an OpenSSL certificate signing request. Before submitting the CSR to a certificate authority, we recommend verifying the information you have. Use one of the widely available online CSR decoders.

SSL is a crucial protocol for securing traffic between a website and its visitors. Helps protect sensitive information online, such as credit card details.