Skip to main content

Create a Certificate Signing Request

The following command creates a new private key and a Certificate Signing Request:

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr

The command creates two files:

  • server.key — Private key
  • server.csr — Certificate Signing Request
warning

The private key must be protected and must not be shared.

OpenSSL will ask for information that will be included in the certificate request.

Example:

  • Country Name (2 letter code) [AU]: AT
  • State or Province Name (full name): Vienna
  • Locality Name (eg, city): Vienna
  • Organization Name (eg, company): Example Company
  • Organizational Unit Name (eg, section):
  • Common Name (e.g. server FQDN or YOUR name): server.example.com
  • Email Address:

For a server certificate, the Common Name (CN) is normally the fully qualified domain name (FQDN) of the server. For a seal, the Common Name (CN) is normally the company name.

Verify the Certificate Request

Before submitting the CSR to the Certificate Authority (CA), verify its contents:

openssl req -in server.csr -noout -text

Check that the following information is correct:

  • Common Name (CN)
  • Organization
  • Organizational Unit
  • Country
  • Subject Alternative Names
  • Public key size

To display only the subject of the request:

openssl req -in server.csr -noout -subject

Security Considerations

warning

The private key must remain confidential.

Do not send the private key to the Certificate Authority or any other third party. Only the CSR file should be submitted to the Certificate Authority.

server.csr -> Submit to the Certificate Authority

server.key -> Keep securely on the server