SSH into your server and navigate to or create a ssl directory.
cd ssl #Navigate mkdir ssl && cd ssl #Create & Navigate
Navigate to our create the csrs directory.
cd csrs #Navigate mkdir ssl && cd csrs #Create & Navigate
Run the following command. Replace domainname with your domain name without an extension (if your domain name is sample.com, enter sample). If you want a stronger private key, use rsa:4096
openssl req -new -newkey rsa:2048 -nodes -keyout domainname.key -out domainname*csr
Output should be similar below with a prompt to start entering data.
Generating a 2048 bit RSA private key ..........................+++ ..+++ writing new private key to 'domainname.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. -----
Enter the following data for each prompt:
- Country Name (required)
- The two-letter abbreviation for your country. For example United States would be “US” and Great Britain would be “GB”.
- State or Province Name (required)
- Enter the full name of the state your organization operates from. For example, “California” or “New York”.
- Locality Name (required)
- Enter the name of the city your organization operates from. For example, “Los Angeles” or “New York City”. If your city has abbreviations, please provide the full name. For example, “Saint Paul” instead of “St. Paul”
- Organization Name (required)
- The name of your organization. If you are a business, provide the legal name of the business. If you are an individual, provide your full name.
- Organizational Unit Name (optional)
- If you are a business, your “Doing Business As” (DBA) name if you have one. Alternatively, you can enter a department name. For example, “IT Department” or “Web Administration”.
- Common Name (required)
- Enter the domain name with extension (e.g. sample.com). If you are generating a CSR for a wildcard SSL, enter the domainname as *.sample.com).
- Email Address
- A contact email address for your organization.
- A challenge password (optional)
- An optional company name (optional)
Once you have entered through all the information above, the certificate will be generated in the csrs directory.
It will have created two files, domainname.csr and domainname.key (domainname will be your domain name). Output the
contents of domainname.csr by using the following command.
cat domainname.csr
Copy the contents of the output. Make sure to copy the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- part.