Creating a Signing Request and Private Key
In order to obtain a signed Digital Certificate, you must create a Certificate
Signing Request, or CSR. At the same time your CSR is created, you will also
generate a Private Key. The CSR is used by the Signing Authority to create a
Signed Digital Certificate which works with your Private Key to provide secure
access to your Web site.
There is some information that you will need to gather before generating the CSR
and Private Key. This information is required as part of the CSR, and must be
entered exactly as you want them to appear in your certificate.
- PEM Passphrase - This is a security phrase which, like a password, ensures that
only you can use your digital certificate. Be sure to use a phrase which you can
easily remember but which is not easily guessed. You will need to enter the
passphrase in the future to install your signed certificate.
- Company Location - You will need to know the country, province or state, and city
where you want the certificate to display as your company location.
- Company Contact Information - This includes the complete company or organization
name, and the organizational unit or department (if applicable).
- Your Domain Name - You will need to determine the exact domain name that you want
to use to access your Web site securely.
- Contact E-mail Address - The contact E-mail address that you want to have the
Signing Authority use when corresponding with you.
- Extra Information - This is additional information that is not required, but may
be useful. It includes a challenge password, which some Signing Authorities use
to allow you access to your certificate and which they may require when
interacting with them. You can also enter additional company information.
Once you have all the information ready to enter, connect to you Virtual Private
Server via SSH or Telnet and run
the following command.
% openssl req -new
You will be asked to provide the information you gathered earlier. Most of the
questions are self explanatory, except that common name refers to the domain
name that you want to use when accessing your site using SSL (ie domain.com or
www.domain.com or cname.domain.com or *.domain.com).
When you have entered all the data, your CSR will be shown. It is a good idea to
save the CSR by copying and pasting it into a file on your local computer. You
will need it when you are ordering your SSL certificate from the Signing
Authority's Web site. The following is an example of a CSR. Note that the CSR
includes the lines with BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST.
-----BEGIN CERTIFICATE REQUEST-----
MIIB2jCCAUMCAQAwgYExCzAJBgNVBAYTAlVTMQ0wCwYDVQQIEwRVdGFoMQ4wDAYD
VQQHEwVQcm92bzETMBEGA1UEChMKU3R1bmt3b3JrczEVMBMGA1UEAxMMTWFyayBT
cGVuY2VyMScwJQYJKoZIhvcNAQkBFhh3ZWJtYXN0ZXJAc3R1bmt3b3Jrcy5jb20w
gZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKIkMHnII4uNDwgTYsBYdiiOBLTY
NOsTfXp/5sG1VXjlYhDMoLzWxBbaulx2hEufj1Sfkm65Mrd8j4nMFVIGf1sGnFCj
ClgxQ/5DJtV22jgnqQfKq7se32r9INoPWjFfjD1JC+4zry5LRiSPNImCYq2E1578
h6S6i6auD1nTDD0LAgMBAAGgGDAWBgkqhkiG9w0BCQcxCRMHZ3JvYmxpbjANBgkq
hkiG9w0BAQQFAAOBgQANwQ7wudkfkxrrZA4lXbOYeXWLngHtNdzPJ8WyzOjGof4h
jkpDPV6SJqHEszpmZljEqb6fxgeiM4cpWSFGJA1QNFz+Ra8/msrLLBMM+zPuHpER
OPFCsrIErmaBgnmymGOk/DiHvhV+LqCkAgjcS2Kpn0cOy8KRyXzUc4k+TTw0Uw==
-----END CERTIFICATE REQUEST-----
In the directory where you were when you ran the openssl command, you will
also find a new file called privkey.pm. This is your private key, which you
will need at a later time. The following is an example of a private key.
Note that the lines containing BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY
are part of the key.
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,BCC23A5E16582F3D
hfWyPkea3gnVCHCZJ/zgQpCH9RZF7WjYXGYohdbfkJY0ETLwXaqjvnNHQlLomwIt
CvAzXhq8wnHur6SK21SO0ry3aSCvrBezH99miSJvtnT0HVlRJDNvaYQDbe01Z26D
hY2Yqha56Z8pvrTTolJfNL0sW4ewdws1wR4kxYDYkpusoe/Wed9Wg+i6xr9YmIjT
le9bbQlPK2D/3gJDhWW/aZHiMmLcYJtmWmf0wUMdmlibWYuq0UH1EefiLq3SLKK2
izvYpWDGHxVgtmzupvoc2E6CS3rQeRN3QQ9RqhzqdGqP8Xy/xl1LMuDRUbPY54Kp
3a4gqZCXdlxctK70XX5TdhiMsFEb5L1wA8CsnKE69nzs8MOLiz6mjtAhGB6KVKB4
dod3Wn6z20cus21SY5LxFkfq6JZrAsqSZFzETN9n2Fbel2pTp3IRWx7Q+WBTlrME
uIMgUSKszpvgzg0Tf2Kxfw6YWl5EpEGA8PeiGrM1NeT2TFtgiQBRQdAy7TQxgBlF
LOW2r5/1347ZgafacXLzpDBHnQrn/OtZijzleeoIwcgVwCOKz1oufEAN1ZTJbG6F
WYJuFtfopM5swyoUYK3JgT582ziAeu4jcPdrNHCxqcInkNG+ib3dHdy8yccWRehD
VnSX2hr1MDd2cpFFTl77Bc2/neNyUieqiHkrTOZIcD9oBSxFd0fP9QxLWEMCDWHt
N5UK1n29+TFgm/aXjZNjSIE5DSjTTBGTy2fPWtnefQaFk23ppV5VQypmZjxcWt2f
Eekjh1vEiQChKULQCXFAaxL61HvBRqe3iJwJ+niOBuGpYnjdC80oIA==
-----END RSA PRIVATE KEY-----
Once you have your CSR and Private Key, the next step is to
Obtain your
signed Digital Certificate.
|
|
