CSR Generator

Self-signed Certificate Generator

This tool creates self-signed certificates that can be used in this test environment. First, provide your data, a public certificate, and a private key. The CSR(certificate signing request) will be created for you.

What is a Certificate Signing Request (CSR)?

One of the first stages toward getting your SSL/TLS certificate is to create a certificate signing request (CSR). The CSR, generated on the same server where the certificate will be installed, provides information that the Certificate Authority (CA) will use to construct your certificate (e.g. common name, organization, and country). It is also signed and contains the public key that will be included in your certificate. 

A CSR (Certificate Signing Request) is a tiny, encoded text file that contains information about your company and the domain you want to secure. It is usually generated on the server where the certificate is to be placed and is required to activate a digital SSL certificate. The Certificate Authority receives a CSR, which is then used to generate the certificate. 
 

What Information Is Needed For Your CSR?

The certificate requester must first create a Certificate Signing Request (CSR) for a domain name or hostname on your web server before you can build your SSL Certificate.
The CSR is a standardized mechanism to submit your public key to the issuing Certificate Authority (CA), linked with a secret private key on the server. It includes the following information about the requester:

1. Common Name (fully qualified domain name [FQDN] your certificate will secure)
2. Country (two-digit code)
3. State or Locality (full names e.g., California or Barcelona)
4. Organization Name (full legal company or personal name as registered in your locality)
5. Organization Unit (department in your organization the certificate is for [e.g., IT or Marketing])

What Exactly Is OpenSSL?

For working with X.509 certificates, certificate signing requests (CSRs), and cryptographic keys, OpenSSL is a convenient open-source command-line tool. If you're running a UNIX-based operating system like Linux or macOS, OpenSSL is almost certainly already installed.

What Exactly Is A Private Key, And Why Do You Require One?

It is a foundation of Public Key Infrastructure. A private key is a critical component of current web security (PKI). It's a cryptographic sequence used to encrypt and decode data in conjunction with an algorithm.
Depending on the complexity and length of a key, brute forcing a website's security system might be amazingly easy or completely difficult. The current minimum prescribed key length, for example, is 2048 bits. By brute-forcing this level of security, it would take trillions of years for modern PCs to breakthrough. 

OpenSSL Commands

• Generate a new private key and Certificate Signing Request

  openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privatekey.key

• Generate a self-signed certificate

  openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout privatekey.key -out certificate.crt

• Generate a certificate signing request (CSR) for an existing private key

  openssl req -out CSR.csr -key privatekey.key -new

• Generate a certificate signing request based on an existing certificate

  openssl x509 -x509toreq -in certificate.crt -out CSR.csr -signkey privatekey.key

• Remove a passphrase from a private key

  openssl rsa -in privateKey.pem -out newprivatekey.pem

• Convert a DER file (.crt .cer .der) to PEM

  openssl x509 -inform der -in certificate.cer -out certificate.pem

• Convert a PEM file to DER

  openssl x509 -outform der -in certificate.pem -out certificate.der

• Convert a PKCS#12 file (.pfx .p12) containing a private key and certificates to PEM

  openssl pkcs12 -in keyStore.pfx -out keystore.pem -nodes

  You can add -nocerts to only output the private key or add -nokeys to only output the certificates.

• Convert a PEM certificate file and a private key to PKCS#12 (.pfx .p12)

  openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile