Generate certificate request CSR

Source: Internet
Author: User
Tags generate csr

Generate certificate request CSR

This series of articles is divided into three parts. It mainly introduces how to build your own certificate issuing service, generate certificate requests, and sign the generated certificate request through the self-built CA and finally apply it to the service.

Create a csr request, and then use the CA signature to generate the certificate.

mkdir /home/cg/mycertcd /home/cg/mycert/mkdir private conf csrvim /home/cg/mycert/conf/serverconfig.cnf[ ca ]default_ca = CA_default[ CA_default ]dir = /home/cg/mycert/certs = $dir/certscrl_dir = $dir/crldatabase = $dir/index.txtnew_certs_dir = $dir/newcertscertificate = $dir/certs/cacert.pemserial = $dir/serial#crl = $dir/crl.pemprivate_key = $dir/private/cakey.pem#RANDFILE = $dir/private/.randx509_extensions = usr_cert#crl_extensions = crl_extdefault_days = 3650#default_startdate = YYMMDDHHMMSSZ#default_enddate = YYMMDDHHMMSSZ#default_crl_days= 30#default_crl_hours = 24default_md = sha1preserve = no#msie_hackpolicy = policy_match[ policy_match ]countryName = matchstateOrProvinceName = matchlocalityName = matchorganizationName = matchorganizationalUnitName = optionalcommonName = suppliedemailAddress = optional[ req ]default_bits = 4096 # Size of keysdefault_keyfile = key.pem # name of generated keysdistinguished_name = req_distinguished_nameattributes = req_attributesx509_extensions = v3_ca#input_password#output_passwordstring_mask = nombstr # permitted charactersreq_extensions = v3_req[ req_distinguished_name ]countryName = Country Name (2 letter code)countryName_default = UScountryName_min = 2countryName_max = 2stateOrProvinceName = State or Province Name (full name)stateOrProvinceName_default = New YorklocalityName = Locality Name (city, district)localityName_default = New YorkorganizationName = Organization Name (company)organizationName_default = Code GharorganizationalUnitName = Organizational Unit Name (department, division)organizationalUnitName_default = ITcommonName = Common Name (hostname, FQDN, IP, or your name)commonName_max = 64commonName_default = CGITemailAddress = Email AddressemailAddress_max = 40emailAddress_default =[ req_attributes ]#challengePassword = A challenege password#challengePassword_min = 4#challengePassword_max = 20#unstructuredName = An optional company name[ usr_cert ]basicConstraints= CA:FALSEsubjectKeyIdentifier=hashauthorityKeyIdentifier=keyid,issuer:always#nsComment = ''OpenSSL Generated Certificate''#nsCertType = client, email, objsign for ''everything including object signing''subjectAltName=email:copyissuerAltName=issuer:copy#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem#nsBaseUrl =#nsRenewalUrl =#nsCaPolicyUrl =#nsSslServerName =[ v3_req ]basicConstraints = CA:FALSEkeyUsage = nonRepudiation, digitalSignature, keyEncipherment[ v3_ca ]subjectKeyIdentifier = hashauthorityKeyIdentifier = keyid:always,issuer:alwaysbasicConstraints = CA:TRUE#keyUsage = cRLSign, keyCertSign#nsCertType = sslCA, emailCA#subjectAltName=email:copy#issuerAltName=issuer:copy#obj=DER:02:03[ crl_ext ]#issuerAltName=issuer:copyauthorityKeyIdentifier=keyid:always,issuer:always

Generate csr
Openssl req-new-config conf/serverconfig. cnf-keyform PEM-keyout private/key. csr. server1.pem-outform PEM-out csr/csr. server1.pem-nodes

File key. csr. server1.pem and csr. server1.pem are generated in the directory $ dir/private and $ dir/csr.

Run csr. server1.pem to generate a certificate for the CA.

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.