Creating a Self-Signed Certificate With OpenSSL
1. Overview
OpenSSL is an open-source command-line tool that allows users to perform various SSL-related tasks.
In this tutorial, we’ll learn how to create a self-signed certificate with OpenSSL.
2. Creating a Private Key
First, we’ll create a private key. A private key helps to enable encryption, and is the most important component of our certificate.
Let’s create a password-protected, 2048-bit RSA private key (domain.key) with the openssl command:
We’ll enter a password when prompted. The output will look like:
If we want our private key unencrypted, we can simply remove the -des3 option from the command.
3. Creating a Certificate Signing Request
If we want our certificate signed, we need a certificate signing request (CSR). The CSR includes the public key and some additional information (such as organization and country).
Let’s create a CSR (domain.csr) from our existing private key:
We’ll enter our private key password and some CSR information to complete the process. The output will look like:
An important field is “Common Name,” which should be the exact Fully Qualified Domain Name (FQDN) of our domain.
“A challenge password” and “An optional company name” can be left empty.
We can also create both the private key and CSR with a single command:
If we want our private key unencrypted, we can add the -nodes option:
A self-signed certificate is a certificate that’s signed with its own private key. It can be used to encrypt data just as well as CA-signed certificates, but our users will be shown a warning that says the certificate isn’t trusted.
Let’s create a self-signed certificate (domain.crt) with our existing private key and CSR:
The -days option specifies the number of days that the certificate will be valid.
We can create a self-signed certificate with just a private key:
This command will create a temporary CSR. We still have the CSR information prompt, of course.
We can even create a private key and a self-signed certificate with just a single command:
5. Creating a CA-Signed Certificate With Our Own CA
We can be our own certificate authority (CA) by creating a self-signed root CA certificate, and then installing it as a trusted certificate in the local browser.
5.1. Create a Self-Signed Root CA
Let’s create a private key (rootCA.key) and a self-signed root CA certificate (rootCA.crt) from the command line:
5.2. Sign Our CSR With Root CA
We can sign our CSR (domain.csr) with the root CA certificate and its private key:
As a result, the CA-signed certificate will be in the domain.crt file. This would result in a working certificate, but browsers would still flag them. This happens because of the changes to the X.509 certificates and the addition of the SAN extension.
5.3. SAN Extension
X.509 certificates need information about the domain for which this particular certificate is issued. For example, the certificate can be valid but used in a different domain than it was issued for. Previously, we could do this with the CommonName of the certificate request. However, after the global adoption of the SAN extension, all domain names should be included in the subjectAltName.
If we create a certificate without a correctly configured subjectAltName, we can still use it. However, browsers will flag it as insecure. This approach might be fine for development. However, using this approach at an organizational level could desensitize employees to security notifications.
To align with SAN extension standards, we need to create a configuration text file (domain.ext) with the following content:
The “DNS.1” field should be the domain of our website.
Then, we can slightly modify our previous command and add the information about the extension file:
Now, our certificate meets all the SAN requirements and works correctly. This process requires an additional step, and openssl doesn’t provide a prompt for this information, so we must create a separate extension file. However, SAN makes the certificates more secure. Also, it allows the definition of several domains or IP addresses and we can use a single certificate across multiple domains.
6. View Certificates
We can use the openssl command to view the contents of our certificate in plain text:
The output will look like:
7. Convert Certificate Formats
Our certificate (domain.crt) is an X.509 certificate that’s ASCII PEM-encoded. We can use OpenSSL to convert it to other formats for multi-purpose use.
7.1. Convert PEM to DER
The DER format is usually used with Java. Let’s convert our PEM-encoded certificate to a DER-encoded certificate:
7.2. Convert PEM to PKCS12
PKCS12 files, also known as PFX files, are usually used for importing and exporting certificate chains in Microsoft IIS.
We’ll use the following command to take our private key and certificate, and then combine them into a PKCS12 file:
8. Conclusion
In this article, we learned how to create a self-signed certificate with OpenSSL from scratch, view this certificate, and convert it to other formats. We hope these things help with your work.
Last updated
