How to Generate a CSR (Certificate Signing Request) in Linux? - GeeksforGeeks

11 Feb, 2021
Certificate Signing Request(CSR) is a block encrypted text which is given to Certificate Authority when applying for SSL Certificate. Generation of Certificate Signing Request(CSR) for Secure Sockets Layer(SSL) is common in Linux on various distributions. CSR is generated on the server, it stores information relating to the organization, domain name, country, a city which is to be included in the certificate.  The CSR Certificate can be used on any website whenever it is necessary to encrypt communications. To generate an SSL certificate, CSR certificate has to be generated. To obtain a self-signed SSL Certificate, it is necessary to create CSR, after generating submit it to a certificate authority to acquire an SSL Certificate. 
There are two kinds of Certificates:
Self-Signed Certificate: Self-Signed Certificates are signed by the identity or its own private key instead of a trusted certificate authority. These certificates are valid for one year. To create an SSL Certificate, the local certificate authority will help who is in your environment which can be used in the organization. It is used for any locally deployed applications and FTP Servers etc.
CA Authorized Certificate: These certificates are issued from the Trusted Third Party entity where they issue digital certificates. It is used on internet-facing servers for data encryption. The certificates have validity depending upon the plan taken. Domain Validation is required to issue CA Certificates.
 
To generate CSR on Debian OS then OpenSSL has to be opened first. OpenSSL is a tool used to generate private keys, create CSR, install SSL/TLS certificate and also identify certificate information. To use OpenSSL Tool to generate CSR it is necessary to install the tool into the Linux System first so to install execute the following command,
$ sudo apt install openssl
Verifying OpenSSL is correctly installed on the Linux System and is also configured properly, execute the command to view the details about OpenSSL and it’s version.
$ openssl version -a
Execute the command to generate CSR. After executing it’ll ask for some information regarding your domain, organization, country and city where you reside. It is necessary to provide the legal information as per the documents as the certificate is verified by CA to issue the certificate.
$ openssl req -new -newkey rsa:2048 -nodes -keyout sample.com.key -out sample.com.csr
$ ls sample.com.csr
The Certificate should be kept confidential and not be shared with anyone. To view the contents of the file use cat utility command.
$ cat sample.com.csr
 
A key file is generated that contains a Private key which is associated with the public key, then it is extracted into another file. To generate a key for domain name MYCSR execute the following command. This key will generate an RSA Algorithm with a key length of 2048-bits. The key is stored in a file and to view the contents stored in PEM Format cat utility function is used
$ openssl req -newkey rsa:2048 -keyout PRIVATEKEY.key -out MYCSR.csr
 
The Certificate should be kept confidential and not be shared with anyone. To view the contents of the key file use cat utility command. Using this command we can navigate to the file where the key is stored. To copy the contents of the private key file select and copy the entire content including “BEGIN RSA PRIVATE KEY” and “END RSA PRIVATE KEY”.
$ cat PRIVATEKEY.key
After the CSR is created, verify the details or the information provided during the generation of CSR Certificate before sending it to CA for signing or self-signing.
$ openssl req -text -in MYCSR.csr -noout -verify
Once CSR is generated, to get the certificate signed, CSR is provided to CA like Verisign, DigiCert etc. In case of test purposes or internal use-cases, there is an option to self-sign the CSR certificates which are in turn done by yourself rather than CA. To Self-Sign Certificate for your own private key execute OpenSSL command,
$ openssl x509 -in MYCSR.csr -out MYCSR.crt -req -signkey PRIVATEKEY.key -days 365
Now, Certificate Signing Request is generated and also private key for your certificate can also be generated to keep the certificate confidential. In the above command, -days is used to specify the validity for the certificate, here validity period for CSR. The output verifies the information provided during the generation of CSR, after which it’ll ask for the passphrase entered by the user while creating of RSA Private key the same is to be entered here in order to get the RSA Private key that was previously created.
Picked
How To
Linux-Unix
Writing code in comment?
Please use ide.geeksforgeeks.org,
generate link and share the link here.
Comments
Old Comments
How to Install FFmpeg on Windows?
How to Install Jupyter Notebook on MacOS?
How to Install Flutter on Visual Studio Code?
How to Override compareTo Method in Java?
How to Install Python Pandas on MacOS?
AWK command in Unix/Linux with examples
Sed Command in Linux/Unix with examples
grep command in Unix/Linux
TCP Server-Client implementation in C
cut command in Linux with examples