How to Generate an OpenSSL Certificate Signing Request

To generate an OpenSSL certificate signing request (CSR), you run a single command that creates a private key and a CSR file containing your public key and identifying details. You then submit the CSR to a certificate authority (CA) to obtain a signed SSL/TLS certificate. This article explains the exact commands, the information you need, and common pitfalls to avoid.

What Is a Certificate Signing Request?

A CSR is a block of encoded text that you send to a certificate authority to request a digital certificate. It contains your public key and information about your organization and domain, such as the common name (the fully qualified domain name), organization name, locality, and country. The CA uses this information to issue a certificate that binds your public key to your identity, enabling secure HTTPS connections.

Prerequisites

Before generating a CSR, ensure you have OpenSSL installed. Most Linux and macOS systems include it by default; on Windows, you can install it via package managers or download a precompiled binary. Verify with openssl version. You also need the domain name you want to secure and, if applicable, your organization’s legal details.

Step-by-Step: Generate a CSR with OpenSSL

1. Generate a private key (RSA 2048-bit is standard; 4096 for higher security):
   openssl genrsa -out yourdomain.key 2048
2. Create the CSR using that key:
   openssl req -new -key yourdomain.key -out yourdomain.csr
3. OpenSSL will prompt for the following fields:

• Country Name (2-letter code, e.g., US)
• State or Province Name (full name)
• Locality Name (city)
• Organization Name (legal name)
• Organizational Unit (department, optional)
• Common Name (the domain, e.g., www.example.com)
• Email Address (optional, often left blank)
• A challenge password (optional, leave blank)

After entering the details, you’ll have a CSR file (yourdomain.csr) that you can submit to a CA.

How to Choose Key Size and Algorithm

RSA is the most widely supported. Use 2048-bit as a minimum; 4096-bit offers more security but requires more CPU. ECDSA keys (using the secp256r1 curve) are faster and shorter, but not all CAs or clients support them. For compatibility, stick with RSA 2048 unless you have specific requirements.

Common Mistakes and How to Avoid Them

• Wrong Common Name: The CN must exactly match the domain you want to secure. Including ‘www’ when your site uses the bare domain (or vice versa) will cause certificate errors.
• Mismatched Private Key: If you lose the private key or generate a new one, the CSR won’t match, and the CA will reject it.
• Including Extra Attributes: Some CAs require you to leave the challenge password and optional company name blank.
• Using the CSR instead of the certificate: After issuance, you need the certificate file, not the CSR, to configure your server.

What to Do After Generating the CSR

Submit the CSR content (the entire block starting with -----BEGIN CERTIFICATE REQUEST-----) to your chosen CA. They will validate your domain and issue a certificate. Once you receive the certificate, install it on your server along with the private key you generated. Keep the private key secure—never share it.

Frequently Asked Questions

Can I generate a CSR for multiple domains?

Yes, but the standard CSR only includes one Common Name. For multiple domains, you need to use the Subject Alternative Name (SAN) extension. With OpenSSL, create a config file with a [alt_names] section and use the -extensions option during CSR generation.

What is the difference between a CSR and a certificate?

A CSR is a request you create; a certificate is the signed result from a CA. The CSR contains your public key and identity info; the certificate contains that same info plus the CA’s digital signature, making it trusted by browsers.

How long does a CSR take to generate?

Generating the CSR itself takes less than a second. The private key generation may take a few seconds depending on your hardware and key size. The CA’s validation and issuance process takes from minutes to days, depending on the CA and validation level.

Can I reuse a CSR?

No. A CSR is tied to the private key and the exact details you entered. If you need a new certificate (e.g., renewal), generate a new CSR and key. Reusing an old CSR is not standard practice.

What if I lose my private key?

You cannot recover it. You must generate a new key and CSR, then re-issue the certificate with the CA. Always back up your private key securely.

Is it safe to share my CSR?

Yes. The CSR contains only public information (your public key and identity details). It is meant to be sent to the CA. Never share your private key.

Related

• dd Command Examples: 12 Real Uses
• Incogni vs DeleteMe: Which Data Removal Service Wins?
• Samsung SD Express MicroSD Cards Explained

in t | Time (minutes) | min | 5 | 0
out s | Seconds | s | t * 60 | 0