In the case that a certificate for a specific url should be created and there is a person or department, that is responsible to sign the certificate request the following procedure can be used. First of all a certificate signing request (CSR
) is needed. As the certificate is bound to a private key to use it afterwards, the request and key are stored.
openssl req -newkey rsa:2048 -keyout key.pem -out request.csr -subj '/C=DE/ST=<your State>/L=<your Location/O=<your company>/CN=<server url>' -sha256
The parameter -sha256
is important. By default openssl uses SHA1 as signature algorithm. SHA1 is no longer supported by the majority of all browsers. The signing request can be checked with
openssl req -in request.csr -noout -text | grep Signature
There should be an output like