CERTIFICATE WORKSHOP / OPENSSL · 6 MIN READ

Create Keys, CSRs and Test Certificates with OpenSSL.

A key, a request and a certificate are three different things. Keep them separate until you know what each file does.

Run these commands locally. Replace aboutssl.info with a domain you control. Use a new, access-restricted working folder and review output filenames before running anything; OpenSSL can overwrite them. Never paste a private key or PFX password into this website, chat, email, or a ticket.

1. Check Your OpenSSL Version

These examples target OpenSSL 3.x. OpenSSL is a separate program, including when you run it from PowerShell. The one-line commands work in a normal terminal or PowerShell when OpenSSL is installed.

openssl version

On Linux or macOS, use umask 077 in your working shell before creating private material. On Windows, choose a folder restricted to your user and the service account that needs the key. Avoid shared folders and automatic cloud synchronization.

2. Generate an Encrypted Private Key

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:3072 -aes-256-cbc -out aboutssl.info.key.pem

Enter a strong, unique passphrase when prompted. The key stays with you; it is not sent to the certificate authority. Keep a protected backup. This RSA example uses 3072 bits; choose an algorithm supported by your server and CA.

3. Create a Certificate Signing Request

openssl req -new -key aboutssl.info.key.pem -out aboutssl.info.csr.pem -subj "/CN=aboutssl.info" -addext "subjectAltName=DNS:aboutssl.info,DNS:www.aboutssl.info"

The Subject Alternative Name extension lists the DNS names requested for the certificate. The apex and www are separate names. A wildcard does not automatically cover the apex. Your CA decides which requested extensions it will issue.

4. Inspect Before Sending

openssl req -in aboutssl.info.csr.pem -noout -verify -text

Check the names and successful CSR signature verification. Give only the CSR to your chosen CA through its authenticated process. A CSR is not an installed certificate and does not make a browser trust the site.

For routine public web hosting, an ACME client can automate issuance and renewal after domain validation. ABOUTSSL does not issue certificates, submit requests to a CA, or manage your DNS.

A Self-signed Certificate for a Lab

This separate example creates a short-lived, non-CA test certificate and a new encrypted key. It is not publicly trusted. Do not deploy it as a replacement for a public website certificate or teach users to bypass browser warnings.

openssl req -x509 -newkey rsa:3072 -sha256 -days 30 -keyout lab.key.pem -out lab.crt.pem -subj "/CN=lab.aboutssl.info" -addext "subjectAltName=DNS:lab.aboutssl.info" -addext "basicConstraints=critical,CA:FALSE" -addext "keyUsage=critical,digitalSignature,keyEncipherment" -addext "extendedKeyUsage=serverAuth"

Use explicit lab trust only on systems you control, and remove that test trust when the lab ends. No command here adds the certificate to a trust store.

After the CA Returns Your Certificate

Save the returned leaf certificate as leaf.pem, obtain the correct intermediates from the CA, and keep your original key. Confirm the names, dates and key match before installing.

openssl x509 -in leaf.pem -noout -subject -issuer -dates -ext subjectAltName

Continue to matching the key and building a PFX →