Generating a Private SSL Certificate
By: Deloris Thompson
Tags: Encryption, Software Engineering, Ssl Certificate, Cybersecurity, Software Development

An SSL certificate is a type of digital certificate that provides authentication for a website and enables an encrypted connection. These certificates communicate to the client that the web service host demonstrated ownership of the domain to the certificate authority at the time of certificate issuance. — Norton

As you create great applications and start to use APIs the need for an SSL Certificate is growing. Knowing how to generate one is important. In less than five minutes, we will generate a private key, create a configuration file, and generate a certificate.pem file.

Step 1: Generating a Private Key

Before we can create the certificate we need to generate a private key. You can create a new directory or use the one that is going to use the certificate. Run the following command:

openssl genrsa -out private-key.pem 2048

This will create a private key for you. Remember to never share this with anyone. Let’s break down the command.

genrsa - This will generate our RSA private key. -out filename - This will save the key to a specified file; ours is private-key.pem 2048 - This sets the size of the private key in bits and is also the default size.

Step II: Create a Configuration File

Our certificate needs more than just a key. It requires some configuration. Create a new file configuration.cnf and add the following code.

[req]

distinguished_name = req_distinguished_name

x509_extensions = v3_req

prompt = no [req_distinguished_name]

C = US

ST = Provide your two letter state abbreviation

L = Provide the name of the city in which you are located

O = Provide a name for your organization

CN = Provide a name for the skill [v3_req]

keyUsage = keyEncipherment, dataEncipherment

extendedKeyUsage = serverAuth

subjectAltName = @subject_alternate_names [subject_alternate_names]

DNS.1 = Provide your fully qualified domain name

Change everything listed below.

ST: Provide your two letter state abbreviation

L: Provide the name of the city in which you are located

O: Provide a name for your organization

CN: Provide a name for the skill

DNS.1: Provide the fully qualified domain name for your endpoint

Step III: Generate the Certificate

Now that we have our configuration set and a private key we need to actually generate the certificate. Run the following command in the same terminal you generated the key.

openssl req -new -x509 -days 365 \\

-key private-key.pem \\

-config configuration.cnf \\

-out certificate.pem

Congratulations. You now have a self-signed certificate named certificate.pem . Always remember to save these files in a safe place.

Example Configuration.cnf

[req]

distinguished_name = req_distinguished_name

x509_extensions = v3_req

prompt = no [req_distinguished_name]

C = US

ST = RI

L = Johnston

O = Echobind

CN = Pokemon Hot or Not [v3_req]

keyUsage = keyEncipherment, dataEncipherment

extendedKeyUsage = serverAuth

subjectAltName = @subject_alternate_names [subject_alternate_names]

DNS.1 = wiseguy.mywebserver.com

Would You Like to Know More?

Deloris is a software engineer at Echobind by day and student, mom, and wife by night. She is obtaining a Bachelors’s in Computer Science at the University of Advancing Technology.

Echobind is a full-service agency specializing in web and mobile app development, team augmentation, custom training, code audits, and digital strategy. Let’s discuss how we can help you build your next web or mobile up from the ground up.