Self Signed SSL Certificates

Self signed SSL certificates can be generated using OpenSSL.

Steps

Private Key

Generate a new private key. The output will be a Privacy-Enhanced Mail (PEM) format.

## Generate a new private key
# openssl genrsa -out server.key 4096

Certificate Signing Request

Generate the certificate signing request.

# openssl req -new -sha256 \
        -key server.key \
        -subj "/C=CA/ST=Alberta/O=Steamr/CN=steamr.com" \
        -reqexts SAN \
        -extensions SAN \
        -config <(cat /etc/ssl/openssl.cnf <(printf "[SAN]\nsubjectAltName=DNS:x.steamr.com,DNS:y.steamr.com")) \
        -out server.csr

The -subj value contains:

Field	Description	Example
C	Country - The 2 letter International Standards Organization ISO abbreviation for your country	CA
ST	State - The state or province of your organization	Alberta
O	Organization - The legal name of the organization	Steamr Corp.
CN	Common Name - The fully qualified domain name for the certificate	steamr.com

Additionally, the [SAN] section passed in through the -config flag is used to define any SANs the certificate should have and can be removed if unneeded.

You can verify your CSR using:

# openssl req -noout -text -in server.csr

After you have verified your CSR, you can either continue to self sign with the next step, or submit it to a CA to purchase a SSL certificate.

Signing

Sign your certificate signing request.

# openssl x509 \
        -req \
        -days 730 \
        -extfile <(printf "subjectAltName=DNS:x.steamr.com,DNS:y.steamr.com") \
        -signkey server.key \
        -in server.csr \
        -out server.crt

The -days value defines the number of days the certificate will be valid for from the time of signing. If not given, a default of 30 days will be used.

Any SANs will also need to be passed through using the -extfile flag.

You can verify the signed certificate by running:

# openssl x509 -noout -text -in server.crt

Renewing

If the certificate has expired, you can 'renew' it by first regenerating a certificate signing request (CSR):

# openssl x509 -x509toreq -in expired_certificate.crt -out new_csr.csr -signkey domain_private.key

Then signing the CSR with the private key to produce a new certificate:

# openssl x509 -req -days 3650 -in new_csr.csr -signkey domain_private.key -out new_certificate.crt

Replace the expired certificate with the new certificate and reload any services that are using the certificate for it to be applied.

Trusting Your Self Signed SSL Certificates

The key and certificate generated with the steps above will not be signed by a trusted certificate authority and therefore cannot be verified by your browser, resulting in a security warning. To get around this, you can add your certificate directly into your browser or operating system's list of trusted certificate authorities.

See Also

• OpenSSL
• https://www.sslshopper.com/article-most-common-openssl-commands.html