0

I am looking for a handy cheat sheet/cookbook recipe for how to locally generate a solid Certificate Signing Request in OS X (10.9; Linux would be of course similar if not the same), that I can use to purchase an SSL cert for my website. I have seem some options out there on the web but haven't seen good rationale for their openssl option choices. Thanks for your answers.

0

1 Answer 1

0

My solution:

openssl genrsa -rand large-file-of-quote-random-data -aes256 -out private.key 2048

You will be asked for a password to encrypt the private key. Next use

openssl req -new -sha256 -key my-private.key -out csr.pem

You will be asked for website params; search the web if you need to know the details. You can then use the contents of csr.pem to upload to the cert provider.

5
  • Bad answer, and it should not be followed. This will place server name in the Common Name (CN), and not the Subject Alternate Name (SAN). It will also use the default hash algorithm rather than SHA256. Use this instead: How to create a self-signed certificate with openssl?. But generate a signing request rather than a self signed certificate.
    – user29925
    Feb 16, 2015 at 3:15
  • @jww Thanks for the -sha256 recommendation. It's very common, though, to have the server name as the CN - this is not "bad."
    – Conrad
    Feb 16, 2015 at 15:09
  • If you place a server name in the CN, then it must also be present in the SAN. Otherwise, the certificate will fail to validate in the browser. The procedures you recommend above do not place the server name in the SAN. Also, its limited to one server name, which is usually a problem in practice.
    – user29925
    Feb 16, 2015 at 16:19
  • @jww All CAs will add the SAN if you don't have it in the CSR. Heck, every Certificate Authority I just looked at does this (has the server name as their CN), so it's definitely not a problem in practice.
    – Conrad
    Feb 16, 2015 at 16:25
  • All CAs won't do it. I run my own CA, and I won't do it. I expect a well formed CSR. I'm really not interested in arguing with you about it. Go read the standards.
    – user29925
    Feb 16, 2015 at 16:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .