CSR and Private Key Generation Using OpenSSL

Step 1. Check OpenSSL Installation

Open your terminal or connect to your server via SSH. Run the following command:

openssl version

If OpenSSL is installed, the command will display its version.

If it is not available, install OpenSSL using your operating system's package manager. OpenSSL is a separate command-line utility and does not need to be installed through npm.

Step 2. Generate a Private Key and CSR

Run the following command:

RSA keys:

openssl req -new -newkey rsa:2048 -noenc -keyout example.com.key -out example.com.csr

ECC keys:

openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -noenc -keyout example.com.key -out example.com.csr

Note: Replace example.com with your domain name.

This command generates two files:

• example.com.key — your private key.
• example.com.csr — your Certificate Signing Request.

Note: If you are using an older OpenSSL version that does not recognize -noenc, replace it with -nodes.

Step 3. Enter the Required Information

OpenSSL will prompt you to enter the following details:

For a Wildcard certificate, enter a name such as *.example.com in the Common Name field.

When prompted for the following additional attributes, leave them blank:

• A challenge password: Do not enter a password.
• An optional company name: Leave blank unless specifically required.

Step 4. Copy and Submit Your CSR

After completing the prompts, OpenSSL will save both files in your current directory.

To display the CSR, run:

cat example.com.csr

Copy the entire CSR, including the header and footer:

-----BEGIN CERTIFICATE REQUEST-----
Your encoded CSR data
-----END CERTIFICATE REQUEST-----

Paste it into the CSR field during your SSL certificate order.