UPDATED 2/4/2021
UPDATE 4/16/2021 – Added commands to
Below are the basic steps to use OpenSSL and create a TLS certificate request using a config file and a private key. You will first create/modify the below config file to generate a private key. Then you will create a .csr. This CSR is the file you will submit to a certificate authority to get back the public cert. Once you have the private key and the resulting public certificate, you will chain them all together (including the CA’s public certs) to create a certificate that you will install on a linux server, load balancer or even convert it to a .pfx file for windows. I’ve been doing this for years and it works very well.
Some gotcha’s… If you are creating wildcard certificates, you always have to have the root domain and the *.domain in the certificate.
For example, if you wan to create a certificate with domaina.com and domainb.com, and support all names like www.domaina.com, abc.domaina.com AND domaina.com, you need to have both the *.domaina.com and domain.com in the SAN area of the config file. Look carefully at the file below. you will see both in it.
Create a config file
Modify this config file to use to create your certificate.
## Start of File
# OpenSSL configuration to generate a new key with signing requst for a x509v3
# multidomain certificate
[ req ]
default_bits = 2048
default_md = sha256
default_keyfile = key.pem
prompt = no
encrypt_key = no
# base request
distinguished_name = req_distinguished_name
# extensions
req_extensions = v3_req
# distinguished_name
[ req_distinguished_name ]
countryName = "US" # C=
stateOrProvinceName = "Minnesota" # ST=
localityName = "Your City" # L=
organizationName = "Your Company" # O=
commonName = "domain.com" # CN=
# req_extensions
[ v3_req ]
# The subject alternative name extension allows various literal values to be
# included in the configuration file
# http://www.openssl.org/docs/apps/x509v3_config.html
subjectAltName = DNS:*.domain.com,DNS:domain.com,DNS:domainb.com,DNS:*domainb.com # multidomain certificate
## End of File
Generate a key for the new certificate.
You could re-use a key but that’s not so secure so always generate a new key every time!
openssl genrsa -out <private key file name>.key 2048
Create the CSR request.
Use the .cnf you created in step 1
openssl req -new -key <private key file name>.key -config <DomainName>.cnf -out <csr file name>.csr
Submit your CSR
Open your .csr file in a text editor (Never use Notepad) and copy the contents. Then submit it to an authority (internal for our sake) and then down load your certificate as a base64. If you are going to submit it to an online authority, use a repeatable authority like DigiCert. Don’t use Thawte or Symantec. They are going away soon.
Merge your public key
Merge your public key, intermediate cert, root cert, and private key (in that order) and save it as a .pem file
NOTE: if this is for a public website, you don’t need to add the root cert to the chain. The browsers computers should have that and it’s trusted more if you leave the root out.
Should look like this (replace your public key and private keys at the top and bottom)
-----BEGIN CERTIFICATE-----
### Replace me with the certificate you received from the authority ###
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
### INTERMEDIATE CERT HERE ###
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
### ROOT CERT HERE ###
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
### replace me with your .key file ###
-----END RSA PRIVATE KEY-----
If necessary, convert your cert from PEM to PFX
If you need to convert your cert from .PEM to .PFX. If you dont need a friendlyname, omit that:
openssl pkcs12 -export -out CERTNAME.pfx -in CERTNAME.pem -name "friendlyname"
Copy your certificate over to your server and install it. You can either install it using the Certificates MMC or import it into IIS. If you are using a .pem file and working on linux, you can import the cert into your load balancer of linux server of choice.
