How to Generate a Certificate Signing Request (CSR) With OpenSSL

Introduction

A Certificate Signing Request (CSR) is the first step in setting up an SSL Certificate on your website. SSL certificates are provided by Certificate Authorities (CA), which require a Certificate Signing Request (CSR).

This guide will instruct you on how to generate a Certificate Signing Request using OpenSSL.

openssl certificate signing request tutorial

Prerequisites

  • Access to a user account with root or sudo privileges
  • A command line/terminal window
  • If you’re working on a remote server, an established SSH connection to the server
  • OpenSSL needs to be installed on your system to generate the key
  • A text editor, such as nano, to view your key

Generate a OpenSSL Certificate Signing Request 

Step 1: Log Into Your Server

Open a terminal window. Use your SSH connection to log into your remote server.

Note: If you are working locally, you don’t need an SSH connection. Also, most Linux systems will launch a terminal window by pressing Ctrl-Alt-T or Ctrl-Alt-F1.

Step 2: Create an RSA Private Key and CSR

It is advised to issue a new private key each time you generate a CSR. Hence, the steps below instruct on how to generate both the private key and the CSR.

openssl req -new -newkey rsa:2048 -nodes -keyout your_domain.key -out your_domain.csr

Make sure to replace your_domain with the actual domain you’re generating a CSR for.

The commands are broken out as follows:

  • openssl – activates the OpenSSL software
  • req – indicates that we want a CSR
  • –new –newkey – generate a new key
  • rsa:2048 – generate a 2048-bit RSA mathematical key
  • –nodes – no DES, meaning do not encrypt the private key in a PKCS#12 file
  • –keyout – indicates the domain you’re generating a key for
  • –out – specifies the name of the file your CSR will be saved as

Note: Use 2048-bit key pairs. The 4096-bit key pairs are more secure, however, they require a lot more server resources.

entering CSR details on server

Step 3: Enter Your CSR Information

Your system should launch a text-based questionnaire for you to fill out.

Enter your information in the fields as follows:

  • Country Name – use a 2-letter country code (US for the United States)
  • State – the state in which the domain owner is incorporated
  • Locality – the city in which the domain owner is incorporated
  • Organization name – the legal entity that owns the domain
  • Organizational unit name – the name of the department or group in your organization that deals with certificates
  • Common name – typically the fully qualified domain name (FQDN), i.e. what the users type in a web browser to navigate to your website
  • Email address – the webmaster’s email address
  • Challenge password – an optional password for your key pair

Please take into account that Organization Name and Unit Name must not contain the following characters:

< > ~ ! @ # $ % ^ * / \ ( ) ? . , &

Step 4: Locate Certificate Signing Request File

Once the software finishes, you should be able to find the CSR file in your working directory.

You can also enter the following:

ls *.csr

The system should list out all certificate signing requests on the system. The one that matches the domain name you provided in Step 2 appended with the .csr extension is the one you need to look into.

Step 5: Submit the CSR as Part of Your SSL Request

You can open the .csr file in a text editor to find the alphanumeric code that was generated.

Enter the following command:

sudo nano your_domain.csr

This text can be copied and pasted into a submittal form to request your SSL certificate from a Certificate Authority.

Make sure you copy the entire text. Some CAs may allow you to simply upload the .csr file you generated. Below is an example of a CSR.

example of a certificate signing request generated

You needn’t send the private key to the CA. Once you get your SSL certificate, the private key on the server will bind with it to encrypt communication.

Conclusion

Now you know how to generate an OpenSSL certificate signing request. Before submitting the CSR to a certificate authority, we recommend verifying the information it holds. Use one of the widely available online CSR decoders.

SSL is a crucial protocol for securing traffic between a website and its visitors. It helps to protect sensitive information online, such as credit card data.

Was this article helpful?
YesNo
Dejan Tucakov
Dejan is the Head of Content at phoenixNAP with over 7 years of experience in Web publishing and technical writing. Prior to joining PNAP, he was Chief Editor of several websites striving to advocate for emerging technologies. He is dedicated to simplifying complex notions and providing meaningful insight into data center and cloud technology.
Next you should read
How to Generate SSH Keys on Ubuntu 18.04
July 29, 2019

Establishing a connection with a remote server without taking the proper security measures can lead to severe consequences. This article is meant to help...
Read more
How to Check the OpenSSL Version Number
June 13, 2019

OpenSSL is an open-source cryptographic library and SSL toolkit. The applications contained in the library help create a secure communication environment for computer networks...
Read more
How to Fix ERR_SSL_VERSION_OR_CIPHER_MISMATCH
May 20, 2019

Are you running into the ERR_SSL_VERSION_OR_CIPHER_MISMATCH error? This error happens in a user’s browser when they try to access a website. It means that there’s a ...
Read more
How to Install MySQL 8.0 in Ubuntu 18.04
December 12, 2018

MySQL is an open-source relational database server tool for Linux operating systems. It is widely used in modern web-based technology, and it forms part of the popular “LAMP” stack of software...
Read more
  • © 2021 Copyright phoenixNAP | Global IT Services. All Rights Reserved.