0

I am looking for a handy cheat sheet/cookbook recipe for how to locally generate a solid Certificate Signing Request in OS X (10.9; Linux would be of course similar if not the same), that I can use to purchase an SSL cert for my website. I have seem some options out there on the web but haven't seen good rationale for their openssl option choices. Thanks for your answers.

migrated from stackoverflow.com Feb 20 '15 at 13:49

This question came from our site for professional and enthusiast programmers.

0

My solution:

openssl genrsa -rand large-file-of-quote-random-data -aes256 -out private.key 2048

You will be asked for a password to encrypt the private key. Next use

openssl req -new -sha256 -key my-private.key -out csr.pem

You will be asked for website params; search the web if you need to know the details. You can then use the contents of csr.pem to upload to the cert provider.

  • Bad answer, and it should not be followed. This will place server name in the Common Name (CN), and not the Subject Alternate Name (SAN). It will also use the default hash algorithm rather than SHA256. Use this instead: How to create a self-signed certificate with openssl?. But generate a signing request rather than a self signed certificate. – jww Feb 16 '15 at 3:15
  • @jww Thanks for the -sha256 recommendation. It's very common, though, to have the server name as the CN - this is not "bad." – Conrad Feb 16 '15 at 15:09
  • If you place a server name in the CN, then it must also be present in the SAN. Otherwise, the certificate will fail to validate in the browser. The procedures you recommend above do not place the server name in the SAN. Also, its limited to one server name, which is usually a problem in practice. – jww Feb 16 '15 at 16:19
  • @jww All CAs will add the SAN if you don't have it in the CSR. Heck, every Certificate Authority I just looked at does this (has the server name as their CN), so it's definitely not a problem in practice. – Conrad Feb 16 '15 at 16:25
  • All CAs won't do it. I run my own CA, and I won't do it. I expect a well formed CSR. I'm really not interested in arguing with you about it. Go read the standards. – jww Feb 16 '15 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.