How to Generate a CSR (Certificate Signing Request)

overview this guide will walk you through the steps to create a certificate signing request (csr) ssl certificates are the industry standard means of securing web traffic to and from your server, and the first step to getting your own ssl is to generate a csr this guide is written specifically for centos 7 steps to generate a csr log onto your server connect to your server using ssh execute openssl command enter the following command at the prompt note replace mydomain with your actual domain name openssl req new newkey rsa 2048 nodes keyout mydomain key out mydomain csr provide certificate details you will be prompted to answer a series of questions to populate your csr please follow these guidelines country name this is the two letter abbreviation for your country for example, the united states would be us and great britain would be gb state or province name this is the full name of the state your organization operates from for example, "california" or "michigan" locality name name of the city your organization operates from examples might include "lansing" or "phoenix" don’t use abbreviations in this field (e g , "st helena" should be "saint helena") organization name the name of your organization if you are a business, you must use your legal name if you are applying as an individual, use your full name instead organizational unit name if applying as a business, you can enter your "doing business as" (dba) name here alternately, you can use a department name here, for example, "it department" or "web administration" common name the domain name that you are purchasing an ssl certificate for this must be a fully qualified domain name (fqdn), such as mydomain com note if you are applying for a special wildcard ssl certificate, you will need to enter an asterisk for the subdomain (e g , mydomain com) never include "http //", "https //", or any other special characters in this field, and do not include text after the top level domain email address an email address that can be used as a point of contact for your domain be sure the address is valid! a challenge password an optional password to further secure your certificate it must be at least 4 characters long you can skip this step if you prefer an optional company name another optional step fill in your company name if you wish this is not required for web ssl certificates completion your csr file has now been generated! finding your csr take a look at the contents of your current working directory with the ls command you should notice two new files ending with " key" and " csr" respectively ls l total 8 rw r r 1 root root 1082 jan 31 12 10 mydomain csr rw 1 root root 1704 jan 31 12 10 mydomain key important security note the key file is your private key and must be kept strictly private on your server the csr file is your certificate signing request and is what you will send to a certificate authority viewing and submitting the csr you can inspect the contents of the csr by using the cat command here is an example of the csr output cat mydomain csr \ begin certificate request miic5jccac4caqawgaaxczajbgnvbaytalvtmrawdgydvqqidadbcml6b25hmraw dgydvqqhdadqag9lbml4mrswgqydvqqkdbjnesbbd2vzb21lienvbxbuyxkxfjau bgnvbasmduluierlcgfydg1lbnqxftatbgnvbammdg15zg9tywlulmnvbtehmb8g csqgsib3dqejarysywrtaw5abxlkb21haw4uy29tmiibijanbgkqhkig9w0baqef aaocaq8amiibcgkcaqeasnljf8u2vvtgisystd/+4einqnwlb30o38hwnf+bi6zs mmraeigl/hrsokfutj/z96pvek9cfo0az12tq9lbzxtqxsjboicvr9lzvrycreyr qsepf8m18yojybfdzxiy13o5sjnd4e0h7gzcldxy930ljj1jqc0o4xabxhd8k7a3 976uh2r6mpdnnq65ug2vknma1mgft9xtd6dqjj3zptqbdg4tnopflg4tnxu2zsyl cx7xhjbkbgx5r/ohqbcqayfpams/7e+gsbkk4jv9mr8w1gc0chsjkpt0tqcn+8lj 1vmi3ysded6bobc/ombxazy2lpalbhvnzy2njprpjwidaqaboaawdqyjkozihvcn aqelbqadggebabuusrgbnv4r1k4uhgngmvq63jjazho6urhqbfzb1e+xheqou1f8 ysp17a8w23hlfxxs/ncohqzan9cfbbgy6dajqmjscf3timgxhitsmuyswpg3k+di bwisrajpmsooz9hci7ztvn1zs6iimczkpi4g+9j5wbqddgxsh+/w5bcviqj0855o apfuyuefsb5js5/e132f5zhczv5vq2bato8zy58gzz5t+q5rn6uuzqc05kmbtdg8 b12rlut2lbbl6sxqdkqbsm6snwn50h3xszgn8kyr1vuxoqakf1x1cckrtszyztup fekv0mmwoc9xxx6ycz8eqy66rmvsm3hgi2y= \ end certificate request when ordering an ssl certificate, you will need to copy and paste the entire contents of the csr file to your certificate authority be sure that you include the lines that read begin certificate request and end certificate request