You can generate a secure shell (SSH) key pair for an Oracle Java Cloud Service instance on a UNIX or UNIX-like platform by using the ssh-keygen utility. Re: How to create AES128 encrypted key with openssl Sure, just get 128 bits of data from /dev/random and you have an AES 128 key that can be used to encrypt anything you like (and decrypt it too). But you can never make an SSL certificate out of such a key. While Encrypting a File with a Password from the Command Line using OpenSSL is very useful in its own right, the real power of the OpenSSL library is its ability to support the use of public key cryptograph for encrypting or validating data in an unattended manner (where the password is not required to encrypt) is done with public keys. Generating Public and Private Keys with openssl.exe To perform the following actions for Windows or Linux, you must have OpenSSL installed on your system. Generating the Private Key - Windows.
In this article you’ll find how to generate CSR (Certificate Signing Request) using OpenSSL from the Linux command line, without being prompted for values which go in the certificate’s subject field.
Below you’ll find two examples of creating CSR using OpenSSL.
In the first example, i’ll show how to create both CSR and the new private key in one command.
And in the second example, you’ll find how to generate CSR from the existing key (if you already have the private key and want to keep it).
Both examples show how to create CSR using OpenSSL non-interactively (without being prompted for subject), so you can use them in any shell scripts.
Use the following command to create a new private key 2048 bits in size example.key
and generate CSR example.csr
from it:
Option | Description |
---|---|
openssl req | certificate request generating utility |
-nodes | if a private key is created it will not be encrypted |
-newkey | creates a new certificate request and a new private key |
rsa:2048 | generates an RSA key 2048 bits in size |
-keyout | the filename to write the newly created private key to |
-out | specifies the output filename |
-subj | sets certificate subject |
Use the following command to generate CSR example.csr
from the private key example.key
:
Option | Description |
---|---|
openssl req | certificate request generating utility |
-new | generates a new certificate request |
-key | specifies the file to read the private key from |
-out | specifies the output filename |
-subj | sets certificate subject |
The magic of CSR generation without being prompted for values which go in the certificate’s subject field, is in the -subj
option.
-subj arg | Replaces subject field of input request with specified data and outputs modified request. The arg must be formatted as /type0=value0/type1=value1/type2=…, characters may be escaped by (backslash), no spaces are skipped. |
The fields, required in CSR are listed below:
Field | Meaning | Example |
---|---|---|
/C= | Country | GB |
/ST= | State | London |
/L= | Location | London |
/O= | Organization | Global Security |
/OU= | Organizational Unit | IT Department |
/CN= | Common Name | example.com |
You’ve created encoded file with certificate signing request.
Now you can decode CSR to verify that it contains the correct information.
ssh-keygen
utility.Specify a filename
for the private key. Also specify the RSA type and a size of 2048.
The command format is: ssh-keygen -b 2048 -t rsa -f filename
For example: ssh-keygen -b 2048 -t rsa -f mykey
Enter passphrase (empty for no passphrase): YourPassphrase
Note:
While a passphrase is not required, Oracle recommends using one as a security measure to protect the private key from unauthorized use. When you specify a passphrase, a user must enter the passphrase every time the private key is used.
The ssh-keygen
utility creates two files:
filename
- The private key
filename.pub
- The public key
Put the output of step 2 into the Public key box and the output of step 4 found in the privateRSA.key file into the Private key box6. Pem certificate format.