A Certificate Signing Request (CSR) is the first step in setting up an SSL Certificate on our website. This is a quick guide on how to generate a CSR using OpenSSL Command.
Generate an RSA Private Key and CSR
We can use the following two commands to generate private key and CSR.
- openssl genrsa -out privateKey.key 2048
- openssl req -new -key privateKey.key -out CSR.csr
Generate an RSA Private Key and CSR in one command
We can use the following one command to generate both the private key and the CSR. It is advised to issue a new private key each time we generate a CSR.
openssl req -new -newkey rsa:2048 -nodes -keyout your_domain.key -out your_domain.csr
- openssl – activates the OpenSSL software
- req – indicates that we want a CSR
- –new –newkey – generate a new key
- rsa:2048 – generate a 2048-bit RSA mathematical key
- –nodes – no DES, meaning do not encrypt the private key in a PKCS#12 file
- –keyout – indicates the domain we are generating a key for
- –out – specifies the name of the file our CSR will be saved as
Enter our CSR Information
Our system should launch a text-based questionnaire for us to fill out. We will get our CSR file in the current directory.
Enter our information in the fields as follows:
- Country Name – use a 2-letter country code (US for the United States)
- State – the state in which the domain owner is incorporated
- Locality – the city in which the domain owner is incorporated
- Organization name – the legal entity that owns the domain
- Organizational unit name – the name of the department or group in our organization that deals with certificates
- Common name – typically the fully qualified domain name (FQDN), i.e. what the users type in a web browser to navigate to our website
- Email address – the webmaster’s email address
- Challenge password – an optional password for our key pair
We can use this command to skip the interactive input.
openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key -subj “/C=US/ST=Florida/L=Saint Petersburg/O=Your Company, Inc./OU=IT/CN=yourdomain.com”
Example of CSR file
CSR file is a common plain-text file. We can use more or cat commands in Linux to check the content of the CSR file.
The file would start with “—–BEGIN CERTIFICATE REQUEST—–” and end with “—–END CERTIFICATE REQUEST—–“.
—–BEGIN CERTIFICATE REQUEST—–
—–END CERTIFICATE REQUEST—–
Verifying CSR Information
After creating our CSR using our private key, we recommend verifying that the information contained in the CSR is correct and that the file hasn’t been modified or corrupted.
Use the following command to view the information in our CSR before submitting it to a CA.
openssl req -text -in your_domain.csr -noout -verify
The -noout switch omits the output of the encoded version of the CSR. The -verify switch checks the signature of the file to make sure it hasn’t been modified.
Submit the CSR to Certificate Authorities
We can open the .csr file in a text editor to find the alphanumeric code that was generated.
This text can be copied and pasted into a submittal form to request our SSL certificate from a Certificate Authority. Make sure we copy the entire text.