Table of Contents
Advertisement
IBM Confidential
Generating a certificate signing request
The req command is used to generate a CSR. The most basic form of this command specifies the name
of the key file you created in the previous step and the name of the output file, which must have a *.csr
extension.
The following example also includes the -SHA256 option, which creates a certificate using the SHA256
signature algorithm.
• Windows
OpenSSL> req -new -key key-filename.pem -out cert.csr -SHA256
• Linux
$ openssl req -new -key key-filename.pem -out cert.csr -SHA256
When you enter the command, you will be prompted to provide the following information. This
information is used to create a distinguishing name (DN) for the certificate.
• The two-letter code for your country, such as US or DE
• The full name of your state or province
• Your city or town
• The name of your organization
• The name of the unit within your organization
• Your name or the host name of the system
• Your email address
• A challenge password – This is not related to the password you assigned when creating the private key.
Leave blank unless you understand when and how to use it.
• Company name – Optional
Generating a self-signed certificate
The req command is also used to generate a self-signed certificate. The output file should have a *.pem
extension.
• Windows
Openssl> req -new -x509 -key key-filename.pem -out selfcert.pem -SHA256
• Linux
$ openssl req -new -x509 -key key-filename.pem -out selfcert.pem -SHA256
Creating the certificate package
When you have the certificate, copy and paste the contents of the certificate file into the file containing
the private key. It should look something like the following (only much longer). The file must have a *.pem
extension.
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-256-CBC,F6F1F37584D8189C97F23F9DCD431B42
qwabUGR9ag09wq1nDtsB3hSuXtJdOBhEn3Wok6qrIWqE8VL8Ss5N7U4MNIWA4G9A ...
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIID4zCCAsugAwIBAgIJALwLp6+xV13iMA0GCSqGSIb3DQEBBQUAMIGHMQswCQYD
VQQGEwJERTEXMBUGA1UEBwwORnJhbmtmdXJ0L01haW4xEzARBgNVBAoMCkRaIEJB
OoD8y9uFwL24rdqR7lCAC5PdPYlf594yOwbUaIVfxBo46vnzmJO3 ...
-----END CERTIFICATE-----
Appendix C. Getting started with SSL certificates 187
Advertisement
Table of Contents
Troubleshooting
