How to make a decent Certificate Signing Request (CSR)?

Question

I'd like to know how to make a decent Certificate Signing Request (CSR) to secure my website and e-mail with a wildcard SSL certificate. With recent exploits as POODLE on SSLv3 and such, I'd like to know how to make a decent Certificate Signing Request to make a valid (and very secure) certificate and order one. I'd love to have a high bits key (at least 2048 bits, 4096 bits if possible). I know where to order, but I would like some more advice on creating the request.

Can someone give more advice on how to make one and on why chosen for those options?

Thanks!

Answer 1

When you create the Certificate Signing Request, you simply need to specify what level of encryption you desire.

For example, for 2048-bit:

openssl req -new -newkey rsa:2048 -nodes -out Test.csr -keyout Test.key

There are a bunch of tools here that will tell you what command to use based on your Operating System and requirements: https://www.digicert.com/csr-creation.htm

When submitting your CSR, make sure you are getting a SHA-2 certificate, as SHA-1 will soon be obsolete.

For protecting against POODLE, as raz mentioned, it is not about the certificates installed. It is up to how you allow your server to authenticate encrypted communication. All versions of SSL need to be disabled on your server to force authentication over TLS instead.