Requesting a Certificate from a
Certificate Authority

Once a Certificate Authority exists, and is trusted by the web browser, then any certificate requests that are signed by them are trusted by the web browser.

Create the Certificate Request

The first step is to create the certificate request. This will go in a file called csr.pem.


# req -new -out csr.pem
Using configuration from /usr/local/ssl/lib/ssleay.cnf
Generating a 1024 bit RSA private key
..+++++
.............+++++
writing new private key to 'privkey.pem'
Enter PEM pass phrase: Requestor's Pass Phrase
Verifying password - Enter PEM pass phrase: Requestor's Pass Phrase Again
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]: Took the default
State or Province Name (full name) [Virginia]: Took the default
Locality Name (eg, city) [Ashburn]: Took the Default
Organization Name (eg, company) [Wizard Workshop and Company]:Sample Company
Organizational Unit Name (eg, section) []:Sample Org Unit
Common Name (Your name) []:wls.wwco.com & nbsp; I used the name of my server.
Email Address []:wls@wls.wwco.com   I used the server's contact address

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: Left it blank
An optional company name []: Left it blank

Signing the Certificate

Once we have the certificate request, it becomes a simpel matter of signing the request.


# x509 -req -CAcreateserial -CA cacert.pem -CAkey cakey.pem -days 365 -in csr.pem -out key.cert
The computer responds with:
Signature ok
subject=/C=US/ST=Virginia/L=Ashburn/O=WWCo/OU=Development/CN=wls.wwco.com/Email=wls@wls.wwco.com
Getting CA Private Key
Enter PEM pass phrase: Now we enter the CA's private key pass phrase

This creates the file key.cert which contains the signed public key of the requestor.

Putting the Key in DER format

Once the key has been signed, you need it in DER format so the browser can use it.

x509 -inform pem -outform der < key.cert > key.cert.der

The question is...

Now what?

Useful Links

Try checking out the SSLeay FAQ and looking at the Generate a Certificate Signing Request (CSR) section.