Skip to content

Generate Self-Signed Certificates with OpenSSL

This document describes how to use the OpenSSL CLI to generate self-signed certificates for enabling SSL.

Steps

  • Step 1: Generate a private key. The private key is used for encryption and identity verification.
openssl genrsa -out domain.key 2048

- `genrsa`: generate an RSA key
- `out`: private key file
- `2048`: key length
  • Step 2: Generate a certificate signing request. The certificate signing request (CSR) is used to request a certificate signature and contains the public key and the information required to generate the certificate.
openssl req -key domain.key -new -out domain.csr

- `req`: certificate request command
- `key`: private key file
- `new`: create a new request
- `out`: CSR file

The generation process is interactive, as shown below:

Enter pass phrase for domain.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:AU
State or Province Name (full name) [Some-State]:stateA
Locality Name (eg, city) []:cityA
Organization Name (eg, company) [Internet Widgits Pty Ltd]:companyA
Organizational Unit Name (eg, section) []:sectionA
Common Name (e.g. server FQDN or YOUR name) []:domain
Email Address []:email@email.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Note: Under the Common Name prompt, enter the actual valid domain name to be used.

  • Step 3: Generate a self-signed certificate. If certificate chain validation is not required, you can directly generate a self-signed certificate to enable certificate-based services.
openssl x509 -signkey domain.key -in domain.csr -req -days 365 -out domain.crt

- `x509`: generate an X.509 certificate
- `signkey`: private key file
- `in`: input CSR file
- `days`: validity period
- `out`: certificate file
  • Step 4: Generate a self-signed CA

Generate the CA certificate and private key:

openssl req -x509 -sha256 -days 1825 -newkey rsa:2048 -keyout rootCA.key -out rootCA.crt

- `req`: certificate request command
- `x509`: generate an X.509 certificate
- `sha256`: SHA-256 hash algorithm
- `days`: validity period in days
- `newkey`: create a new key
- `rsa:2048`: RSA encryption algorithm with a 2048-bit key
- `keyout`: private key file
- `out`: certificate file

Use the root CA to sign the certificate.

Create an ext file.

Note: Replace domain with the actual valid domain name to be used.

authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
subjectAltName = @alt_names
[alt_names]
DNS.1 = domain

Use the CA certificate and private key to sign the certificate:

openssl x509 -req -CA rootCA.crt -CAkey rootCA.key -in domain.csr -out domain.crt -days 365 -CAcreateserial -extfile domain.ext

References