How to Generate an ECC CSR and Private Key for Apache
-
ECC certificates use smaller keys than RSA while offering the same level of security. Here's how to generate an ECC private key and CSR on an Apache server with OpenSSL, and how to check the CSR before ordering.
- Automatic renewals
- Less manual work
-
-
*
Before You Start
You'll need SSH access to your server, OpenSSL, and Apache 2.4 or later. You can also create an ECC CSR with the GoGetSSL online CSR generator, which supports both RSA and ECC keys. Generating the CSR on your server with OpenSSL, as shown below, means the private key is created where it will be used and never has to be copied.
You'll also need to choose a curve. P-256 (called prime256v1 in OpenSSL) is the standard choice and works with all modern browsers. P-384 (secp384r1) is stronger but slightly slower and is rarely needed for websites. For more on ECC and compatibility, see ECC, RSA, and SHA in SSL Certificates.
-
*
Step 1: Generate the Private Key
Run this command to create a P-256 private key. To use P-384 instead, replace prime256v1 with secp384r1:
openssl ecparam -name prime256v1 -genkey -noout -out server.keyThen restrict access to the key so only its owner can read it:
chmod 600 server.keyImportant: Keep the server.key file safe and make a backup. You'll need it to install the certificate, and the certificate authority never receives a copy. If the key is lost, the certificate has to be reissued with a new CSR.
-
*
Step 2: Generate the CSR
Create the CSR from your new key:
openssl req -new -key server.key -out server.csr -sha256OpenSSL asks for several details:
- Country Name, State or Province, Locality, Organization Name. For OV and EV certificates, enter your company's details exactly as they appear in the official business register. For DV certificates, you can leave them blank by typing a period (.).
- Organizational Unit Name. Leave it blank. Certificate authorities no longer include this field in certificates.
- Common Name. Enter the domain you're securing, such as www.example.com. For a wildcard certificate, enter *.example.com.
- Email Address, challenge password, and optional company name. Leave them blank.
Tip: To skip the questions, add all details to the command with the -subj option. Fields you leave out stay blank:
openssl req -new -key server.key -out server.csr -sha256 -subj "/C=US/O=Example Inc/CN=www.example.com" -
*
Step 3: Check the CSR
Before ordering, make sure the CSR contains the right details and an ECC key:
openssl req -in server.csr -noout -text -verifyCheck that the output includes verify OK, Public Key Algorithm: id-ecPublicKey, the curve you chose (for example, ASN1 OID: prime256v1), and the correct domain in the Subject line. You can also paste the CSR into the GoGetSSL CSR Decoder.
-
*
Step 4: Submit the CSR
Open server.csr in a text editor and copy its full contents, including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines. Paste it into the CSR field of your GoGetSSL order.
Once the certificate is issued, install it together with the server.key file. For installation steps, see the guides from DigiCert and Sectigo.
-
