Creating a Certificate Request with OpenSSL

Creating a Certificate Request with OpenSSL is a practical guide that explains how to generate a CSR (Certificate Signing Request) and private key using OpenSSL. In this lab environment, we will use OpenSSL on Windows to create the required files before submitting the certificate request to a Certificate Authority.

OpenSSL is a widely used tool for working with digital certificates, allowing administrators to generate private keys, certificate requests, and manage different cryptographic operations. The CSR file created during this process contains the certificate information that will be used by the CA to issue the final certificate.

In this article, we will demonstrate step-by-step how to prepare the certificate details file, generate the CSR and private key files, and understand the main parameters used during the OpenSSL certificate request creation process.

In this lab, we are using OpenSSL on Windows. You can download the OpenSSL on the below link:

• https://slproweb.com/products/Win32OpenSSL.html

Creating a text file with your Certificate Details

The first step here is creating the text file with certificate details. You can use Notepad++ or your preferred text editor to complete this step.

Create a new file and put the below information:

[ req ]
default_bits = 2048
distinguished_name = req_distinguished_name
req_extensions = req_ext
prompt = no

[ req_distinguished_name ]
countryName = BR
stateOrProvinceName = SP
localityName = SP
organizationName = DPC Virtual Tips
organizationalUnitName = IT
commonName = nsx.lab.local

[ req_ext ]
subjectAltName = @alt_names

[alt_names]
DNS.1 = nsx.lab.local
DNS.2 = nsx-01.lab.local
DNS.3 = nsx-02.lab.local
DNS.4 = nsx-03.lab.local
IP.1 = 10.0.0.1
IP.2 = 10.0.0.2
IP.3 = 10.0.0.3
IP.4 = 10.0.0.4

Choose a file name and save that (in this example, we saved the file with “nsx-cert.txt”):

Generating the Certificate Signing Request and the Certificate Private Key

At this point, we need to generate the certificate request and the private key. We will do it with OpenSSL.

Firstly, open the Windows CMD and navigate to the openssl.exe directory:

cd C:\Program Files (x86)\GnuWin32\bin

Run the command below to generate the CSR file and the KEY file:

openssl.exe req -out C:\temp\nsx-cert.csr -newkey rsa:2048 -nodes -keyout C:\temp\nsx-cert.key -config C:\temp\nsx-cert.txt -sha256

Where:

-out C:\temp\nsx-cert.csr = The file that will be created containing the Certificate Request

-keyout C:\temp\nsx-cert.key = The file that contains the private key for this Certificate

-config C:\temp\nsx-cert.txt = The file that contains all details about the Certificate (this file has been created by us before)

On the C:\temp directory, we can see all files:

At this point, the Certificate Request is done. The next step is to send the CSR file to the CA (Certificate Authority) to sign this certificate and create the final certificate for us.

The CSR file content is: