Creating a Self-Signed Certificate: Difference between revisions

Revision as of 16:46, 22 May 2021

Standard Certificates

You can do that in one command:

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes

The -nodes option disables protecting your cert with a passphrase, otherwise it will prompt you for "at least a 4 character" password. The days parameter (365) you can replace with any number to affect expiration date. It will then prompt you for things like "Country Name" but you can just hit enter and accept defaults. Self-signed certs are not validated with any third party unless you import them to the browsers previously. If you need more security, you should use a certificate signed by a CA

Add -subj '/CN=localhost' to suppress questions about the contents of the certificate (replace localhost with your desired domain)

Creating a Cert with a SAN

Create a file named san.cnf with the following information:

[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no
[req_distinguished_name]
C = US
ST = VA
L = SomeCity
O = MyCompany
OU = MyDivision
CN = www.company.com
[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = www.company.net
DNS.2 = company.com
DNS.3 = company.net

Note: alt_names section is the one you have to change for additional DNS. You can also use IP.1 entries to insert IP addresses as SANs

Save the file and execute the following OpenSSL command, which will generate PEM and KEY file

openssl req -x509 -nodes -days 730 -newkey rsa:2048 -keyout sancert.key -out sancert.pem -config san.cnf -extensions 'v3_req'

Converting .pem to .crt

In most cases, a simple copy or rename will suffice, but if necessary, use openssl to convert the certificate:

openssl x509 -in sancert.crt -out sancert.pem -outform PEM

Reading/Verifying a certificate

openssl x509 -in cert.pem -text -noout

@@ Line 12: / Line 12: @@
 == Creating a Cert with a SAN ==
-(from https://geekflare.com/san-ssl-certificate/)
 Create a file named ''san.cnf'' with the following information:
-<pre>[ req ]
+<pre>[req]
-default_bits       = 2048
 distinguished_name = req_distinguished_name
-req_extensions     = req_ext
+x509_extensions = v3_req
-[ req_distinguished_name ]
+prompt = no
-countryName                 = Country Name (2 letter code)
+[req_distinguished_name]
-stateOrProvinceName         = State or Province Name (full name)
+C = US
-localityName               = Locality Name (eg, city)
+ST = VA
-organizationName           = Organization Name (eg, company)
+L = SomeCity
-commonName                 = Common Name (e.g. server FQDN or YOUR name)
+O = MyCompany
-[ req_ext ]
+OU = MyDivision
+CN = www.company.com
+[v3_req]
+keyUsage = keyEncipherment, dataEncipherment
+extendedKeyUsage = serverAuth
 subjectAltName = @alt_names
 [alt_names]
-DNS.1   = bestflare.com
+DNS.1 = www.company.net
-DNS.2   = usefulread.com
+DNS.2 = company.com
-DNS.3   = chandank.com</pre>
+DNS.3 = company.net</pre>
 Note: alt_names section is the one you have to change for additional DNS.  You can also use ''IP.1'' entries to insert IP addresses as SANs
-Save the file and execute the following OpenSSL command, which will generate CSR and KEY file
+Save the file and execute the following OpenSSL command, which will generate PEM and KEY file
-  openssl req -out sancert.csr -newkey rsa:2048 -nodes -keyout sancert.key -config san.cnf
+  openssl req -x509 -nodes -days 730 -newkey rsa:2048 -keyout sancert.key -out sancert.pem -config san.cnf -extensions 'v3_req'
-This will create sslcert.csr and private.key in the present working directory.  Then you can turn that CSR into a certificate using this command:
- openssl x509 -req -days 365 -in sancert.csr -signkey sancert.key -sha256 -out sancert.crt
 == Converting .pem to .crt ==