#Openssl create csr how to

To set basic constraints on the CSR, use the -addext option when using OpenSSL. It will look like the following: Setting basicConstraints on the CSR If you receive the following error, make sure that your IP address is formatted properly and is indeed an IP address and not a DNS name: Error Loading command line extensionsġ40239286240576:error:220A4076:X509 V3 routines:a2i_GENERAL_NAME:bad ip address./crypto/x509v3/v3_alt.c:473:value=140239286240576:error:22098080:X509 V3 routines:X509V3_EXT_nconf:error in extension./crypto/x509v3/v3_conf.c:47:name=subjectAltName, value=IP:Then decode the CSR, described below, to verify the IP address is set as a Subject Alternative Name (SAN) on the CSR. To include the IP SAN in the CSR with the command line option, run the following: openssl req -new -subj '/C=US/CN=' -addext 'subjectAltName = IP:10.10.10.10' -newkey rsa:4096 -keyout key.pem -out req.pem If you do not wish to create the config file for the IP SAN configuration, you can add the subjectAltName extension, similar to the example above. Then run the same openssl command as above, pointing to the configuration file with -config config to create the CSR with an IP SAN (Subject Alternative Name).Īlternatively, you can skip the CSR generation and go straight to creating a self signed certificate with an IP SAN with the following command: openssl req -x509 -nodes -days 1825 -newkey rsa:2048 -keyout key.pem -out cert.pem -config config After creating the configuration file, add the following to it to include the DNS. This can be achieved using similar config as above. Adding an IP address SAN to a CSRįor internal systems and applications that may not have a dire need for a DNS name, it may be easier to add a SAN to the certificate in the form of the IP address instead of DNS name. Again, specify -subj to provide the subject in the command rather than being prompted for it. This can make the processing of generating your CSR much quicker and programmatic. This will add the subject alternative name to your CSR, and then pick up with step number 3 above to inspect and then submit your CSR.Īlso, by specifying -subj you are providing the subject information in the command instead of being prompted. To include SANs in your CSR with a command line option, run the following openssl command: openssl req -new -subj '/C=US/CN=' -addext 'subjectAltName = DNS:-newkey rsa:4096 -keyout key.pem -out req.pem Submit your CSR to a Certification Authority listed below.

Inspect your generated CSR for the SANs.Ĥ. Run the following openssl command: openssl req -new -out example.csr -newkey rsa:2048 -nodes -sha256 -keyout example.key -config configģ. KeyUsage = keyEncipherment, dataEnciphermentĭNS.2 = 2. To include SANs in your CSR with a configuration file, do the following:ĭistinguished_name = req_distinguished_name In the case of the former, you can add the to the CSR with an additional option to your OpenSSL command or by use of a configuration file. Many CAs will expose an API allowing SANs to be included with the CSR or as a separate parameter. BEGIN NEW CERTIFICATE REQUEST-Īnd the footer: -END NEW CERTIFICATE REQUEST-Īdding a Subject Alternative Name (SAN) to the CSRĭepending on the Certification Authority (CA), SANs may or may not be supported in the CSR.

Some CSRs may be generated with a header and footer like the following, but this is less common. The CA will only need the CSR to generate and issue the SSL certificate and WILL NOT need the private key.Ī Certificate Signing Request header looks like the following: -BEGIN CERTIFICATE REQUEST-Īnd the footer looks like: -END CERTIFICATE REQUEST. Different web servers require the private key to be stored in different ways, but regardless, always remember to protect the private key. This should be generated on the server where the SSL certificate will be installed.

#Openssl create csr how to

Examples are provided below on how to generate a CSR, and take note that the private key generated along with the CSR should be kept secret. The CSR in PKI is created along with the public/private key pair and contains the public key. A Certificate Signing Request (CSR) is the request file to be sent to a Certification Authority (CA) when requesting an SSL certificate.