A Certificate Signing Request (CSR) is the first step in setting up an SSL Certificate on your website. SSL certificates are provided by Certificate Authorities (CA), which require a Certificate Signing Request (CSR).
Generate a CSR for Apache with OpenSSL These instructions are suitable for any server using ApacheSSL or Apache+modssl or Apache 2. On the contrary do not apply these instructions on servers with an overlayer (Cobalt, Plesk, etc.) or Tomcat Generate a CSR for Tomcat.
This guide will instruct you on how to generate a Certificate Signing Request using OpenSSL.
Access to a user account with root or sudo privileges
A command line/terminal window
If you’re working on a remote server, an established SSH connection to the server
OpenSSL needs to be installed on your system to generate the key
A text editor, such as nano, to view your key
Open a terminal window. Use your SSH connection to log into your remote server.
Note: If you are working locally, you don’t need an SSH connection. Also, most Linux systems will launch a terminal window by pressing Ctrl-Alt-T or Ctrl-Alt-F1.
Step 2: Create an RSA Private Key and CSR
It is advised to issue a new private key each time you generate a CSR. Hence, the steps below instruct on how to generate both the private key and the CSR.
Make sure to replace your_domain with the actual domain you’re generating a CSR for.
The commands are broken out as follows:
openssl – activates the OpenSSL software
req – indicates that we want a CSR
–new –newkey – generate a new key
rsa:2048 – generate a 2048-bit RSA mathematical key
–nodes – no DES, meaning do not encrypt the private key in a PKCS#12 file
–keyout – indicates the domain you’re generating a key for
–out – specifies the name of the file your CSR will be saved as
Note: Use 2048-bit key pairs. The 4096-bit key pairs are more secure, however, they require a lot more server resources.
Your system should launch a text-based questionnaire for you to fill out.
Enter your information in the fields as follows:
Country Name – use a 2-letter country code (US for the United States)
State – the state in which the domain owner is incorporated
Locality – the city in which the domain owner is incorporated
Organization name – the legal entity that owns the domain
Organizational unit name – the name of the department or group in your organization that deals with certificates
Common name – typically the fully qualified domain name (FQDN), i.e. what the users type in a web browser to navigate to your website
Email address – the webmaster’s email address
Challenge password – an optional password for your key pair
Please take into account that Organization Name and Unit Name must not contain the following characters:
< > ~ ! @ # $ % ^ * / ( ) ?.,&
Once the software finishes, you should be able to find the CSR file in your working directory.
You can also enter the following:
The system should list out all certificate signing requests on the system. The one that matches the domain name you provided in Step 2 appended with the .csr extension is the one you need to look into.
Step 5: Submit the CSR as Part of Your SSL Request
You can open the .csr file in a text editor to find the alphanumeric code that was generated.
Enter the following command:
This text can be copied and pasted into a submittal form to request your SSL certificate from a Certificate Authority.
Make sure you copy the entire text. Some CAs may allow you to simply upload the .csr file you generated. Below is an example of a CSR.
You needn’t send the private key to the CA. Once you get your SSL certificate, the private key on the server will bind with it to encrypt communication.
Now you know how to generate an OpenSSL certificate signing request. Before submitting the CSR to a certificate authority, we recommend verifying the information it holds. Use one of the widely available online CSR decoders.
SSL is a crucial protocol for securing traffic between a website and its visitors. It helps to protect sensitive information online, such as credit card data.
Next, You Should Also Read:
These instructions are suitable for any server using ApacheSSL or Apache+mod_ssl or Apache 2. On the contrary do not apply these instructions on servers with an overlayer (Cobalt, Plesk, etc.) or Tomcat Generate a CSR for Tomcat.
New: Use our command line generator
In order to gain some time, you can now generate your command line with our CSR creation assistant tool. Just copy/paste to finalize ! To install a certificate on Apache Windows, you will need a cryptographic tool to generate the private key and the CSR. To do so, you can use 'OpenSSL':Install OpenSSL on a Windows computer
1- Generate the private key
Connect under root and access the setup directory of your Apache server. It is often:
We'll place our working files here but you can choose an other repertory.
Choose a file's name that fits you and generate the key with the following command:
If you want this key to be protected by a password (that will be requested any time you'll restart Apache), add: '-des3' after 'genrsa'.
You can also enhance the quality of your key. To do so, add the instructions below after 'genrsa': '-rand/var/log/messages'. It enables random numbers to be used.
Make a backup copy of the .key file!
Protect your file with:
2- Create your certificate request (CSR)
Apache Generate Csr And Private Key Mac
Use this command to generate the CSR:
The system will then ask you to fill in fields. To do so respect instructions of the page Obtain a server certificate Country Name (2 letter code) []: (FR in France for example) State or Province Name (full name) [Some-State]: (your state or province name, name of your département in France) Locality Name (eg, city) []: (the name of your city) Organization Name (eg, company) []: (your organization name) Organizational Unit Name (eg, section) []: (do not fill - advised - or enter a generic term such as 'IT Department'.) Common Name (eg, YOUR name) []: (the name of the website to be secured) Email Address []: (let blank)
Do not fill in fields such as: 'A challenge password' or 'An optional company name'
3- Finalize the order process
Use the appropriate link to place your order on our website. See Access an order form
Copy/paste the content of the www.example.com.csr file in the form.
Configuration and use options of OpenSSL
To generate the CSR, OpenSSL reads openssl.cnf by default. But on some platform this file is not appropriate. In that case you can download ours:
For Symantec or Thawte server certificates: openssl-dem-server-cert-thvs.cnf
For TBS X509 or Sectigo server certificates: openssl-dem-server-cert.cnf
For Certigna Server Client certificates: openssl-dem-certigna-srv-cli.cnf
For Apache under Windows, the instructions are the same. You just need to make sure you have installed Apache with OpenSSL first.Download it here. Concerning the remaining instructions, just replaceopenssl by openssl.exe
OpenSSL and SHA256
By default, OpenSSL cryptographic tools are configured to make SHA1 signatures. for example, if you want to generate a SHA256-signed certificate request (CSR) , add in the command line: -sha256, as in: