The following instructions will guide you through the CSR generation process on Apache OpenSSL. To learn more about CSRs and the importance of your private key, reference our Overview of Certificate Signing Request article. If you already generated the CSR and received your trusted SSL certificate, reference our SSL Installation Instructions and disregard the steps below.
1. Log In
Log in to your server’s terminal via Secure Shell (SSH).
2. Run CSR Generation Command
Generate a private key and CSR by running the following command:Here is the plain text version to copy and paste into your terminal:
Note: Replace “server” with the domain name you intend to secure.
3. Enter your Information
Enter the following CSR details when prompted:
Step 1: Verify that you have openssl installed.$ which openssl/usr/bin/openssl$If not, install openssl using:$ brew install openssl$If you are using Microsoft(r) Windows, checkout for details about the openssl package on Windows.If you using Linux, you can use the default package manager to get the openssl package installed on your box. To know more about what is a PEM file and it’s significance, read at.Step 3: Create the Certificate Signing Request (CSR) utilizing the RSA private key we generated in the last step.# The below command will ask you for information that would be included in the certificate. Since this is a self-signed certificate, there is no need to provide the 'challenge password' (to leave it blank, press enter).$ openssl req -new -key server.key -out server.csrYou are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.' For example:# In case of Ubuntu:$ sudo apt-get install openssl$Step 2: Create a RSA private key.# The below command will create a file named 'server.pass.key' and place it in the same folder where the command is executed.$ openssl genrsa -des3 -passout pass:x -out server.pass.key 2048# The below command will use the 'server.pass.key' file that just generated and create 'server.key'.$ openssl rsa -passin pass:x -in server.pass.key -out server.key# We no longer need the 'server.pass.key'$ rm server.pass.key$server.key is a PEM RSA private key. , the field will be left blank.-Country Name (2 letter code) AU:State or Province Name (full name) Some-State:Locality Name (eg, city) :Organization Name (eg, company) Internet Widgits Pty Ltd:Organizational Unit Name (eg, section) :Common Name (e.g. Java generate rsa key pair.
- Common Name: The FQDN (fully-qualified domain name) you want to secure with the certificate such as www.google.com, secure.website.org, *.domain.net, etc.
- Organization: The full legal name of your organization including the corporate identifier.
- Organization Unit (OU): Your department such as ‘Information Technology’ or ‘Website Security.’
- City or Locality: The locality or city where your organization is legally incorporated. Do not abbreviate.
- State or Province: The state or province where your organization is legally incorporated. Do not abbreviate.
- Country: The official two-letter country code (i.e. US, CH) where your organization is legally incorporated.
Note: You are not required to enter a password or passphrase. This optional field is for applying additional security to your key pair.
The private key however is stored on the machine that generated the CSR (presumably the server requiring the cert, but not necessarily) and is NOT included in the contents of the CSR, and may not be derived from the CSR. It is kept private. In general terms, the server generating the CSR generates a key pair (public and private). I am using the following command in order to generate a CSR together with a private key by using OpenSSL: openssl req -new -subj '/CN=sample.myhost.com' -out newcsr.csr -nodes -sha512. How to Generate a CSR for Apache Web Server Using OpenSSL The following instructions will guide you through the CSR generation process on Apache OpenSSL. To learn more about CSRs and the importance of your private key, reference our Overview of Certificate Signing Request article. A CSR is a file containing your SSL Certificate application information, including your Public Key. Certificate Auto-Requester: We provides a useful tool to automatically create a public/private key pair on your local machine then use this key pair to generate a CSR and automatically submit it to us over a secure SSL connection to create your certificate for Apache.
4. Copy the CSR text from the file
Locate and open the newly created CSR in a text editor such as Notepad and copy all the text including:
Note 1: Your CSR should be saved in the same user directory that you SSH into unless otherwise specified by you. Note 2: We recommend saving or backing up your newly generate “.key” file as this will be required later during the installation process.
5. Generate the order
Return to the Generation Form on our website and paste the entire CSR into the blank text box and continue with completing the generation process.
Upon generating your CSR, your order will enter the validation process with the issuing Certificate Authority (CA) and require the certificate requester to complete some form of validation depending on the certificate purchased. For information regarding the different levels of the validation process and how to satisfy the industry requirements, reference our validation articles.
After you complete the validation process and receive the trusted SSL Certificate from the issuing Certificate Authority (CA), proceed with the next step using our SSL Installation Instructions for Apache OpenSSL.
Was this article helpful?
Related Articles
Applicable Products
- NetScaler Gateway
- NetScaler
Objective
This article describes how to generate SHA2 Certificate Signing Request (CSR) on NetScaler using OpenSSL.
Openssl Generate Key Pair And Csr Key
Background
Currently there is no option to create SHA2 CSR from NetScaler GUI however you can leverage the OpenSSL commands for creating SHA2 CSR from NetScaler.
Instructions
Complete the following steps to generate SHA2 CSR on NetScaler using OpenSSL:
Create a custom configuration file named openssl.cnf. The file can have the following entries. Modify the entries according to the requirement. You can create this file on NetScaler using the VI editor or any other editor.
Upload the openssl.cnf file to the /nsconfig/ssl directory.
Log on to NetScaler using PuTTY.
Browse to the /nsconfig/ssl directory and execute the following command to create a Key and CSR:
root@ns# openssl req -out test.csr -config openssl.cnf -new -newkey rsa:2048 -nodes -keyout test.keyUse the following command to verify if the CSR created is SHA2:
root@ns# openssl req -text -noout -in test.csr grep 'Signature Algorithm'
The preceding article helps you in generating the CSR by creating a new key. However, if you want to use an existing key, then use the following command:
openssl req -out csr.csr -key /nsconfig/ssl/existing_key.key -new -sha256 -config /etc/nsssl.conf
Additional Resources
Alternatively you can run the following command from the shell to generate SHA2 CSR:
#openssl req -config /etc/nsssl.conf -newkey rsa:2048 -sha256 -nodes -out test.csr -outform PEM
The 'nsssl.conf' file is a NetScaler OpenSSL configuration file.
Run the following command to confirm the SHA algorithm used:
#openssl req -text -noout -verify -in test.csr