Generating CSRs for SSL Certificates

• About
• Services
• Account
• Support
• News
•  

Generating CSRs for SSL Certificates

• The Common name
• Apache-SSL
• Raven SSL
• SSLeay
• Cobalt Raq
• C2Net Stronghold Web Server
• IBM HTTP Server
• iPlanet 4.x
• iPlanet 6.x
• Lotus Domino Go server
• Ensim server
• Microsoft IIS 4.0
• Microsoft IIS 5.0
• Netscape Commerce
• O'Reilly Website Professional
• 4D Webstar Server Suite
• Zeus Server

To obtain an SSL certificate, you first need to generate a Certificate Signing Request. This request include the common name and contact information. This is presented to a certificated authority who isues the SSL Certificate.

The Common Name

NOTE: When asked for your Common Name, enter the exact FQDN (fully qualified domain name) of the server you want to secure (i.e. "www.example.com" or "secure.example.com"). The prompt on some standard SSL distributions asks for "YOUR name", this is the Common Name

Throughout this document we use "www.example.com" and "secure.example.com". Any place you see either of these host names you should expect to enter the FQDN of the the server you are creating the CSR for. Providing the wrong Common Name is the single most common cause of problems.

Generate CSR for Apache-SSL

Step 1. Go to your SSL directory

	# cd /usr/local/ssl/private

Step 2. Generate a private key

	# openssl genrsa -des3 1024 > secure.example.com.key

Now PLEASE backup your secure.example.com.key and make a note of the passphrase.

Step 3. Go to your certs directory

# cd /usr/local/ssl/certs

Step 4. Generate a CSR from your key

# openssl req -new -key ../private/secure.example.com.key > secure.example.com.csr

Raven SSL

Please make sure that you backup the private key once it has been generated. Your certificate will not work without that private key.

For users of Raven 1.2, the certificate generation process is invoked with the following command typed at a shell prompt.

# ./ravenctl -cert

The process first prompts for the name of the certificate. Please enter the server name you wish to generate for.

Name of the server you are issuing certificate for? --> secure.example.com

##############################################
The key name chosen is secure.example.com.key.
The certificate name is secure.example.com.cert.
The key/certificate pairs will be stored in /usr/local/ssl.
##############################################

You are about to generate a new key and key request. The key request will be sent to the email address of your choice and the keyfile will reside in /usr/local/ssl/private/secure.example.com.key.

Choose the size of your key. Smaller key sizes provide faster server response but will provide diminished security. Keys sizes less than 512 bits are easily cracked. For high security applications you will probably want a key sized not less than 1024 bits.

The process first prompts for the name of the certificate. Input your choice of key size at the prompt.

Number of bits in key (384 minimum, 1024 maximum)? -->  512

Generating random data
 ................................

Choose a pass phrase that is secure. Don't forget this password.

Enter PEM pass phrase: ...................
Verifying password - Enter PEM pass phrase: ...................

Key successfully generated.

You'll be prompted as to whether you will be sending the Certificate Request to a CA. Answer Yes to this and No to question regarding the ASN1-Kludge

Would you like to send a Certificate Request to a CA? [Y/n]: -->  y
Does your CA need the ASN1-Kludge? (VeriSign) [y/N]: -->  n

Generating certificate request. This process will also create a temporary certificate for testing until you receive the certificate from your CA. Please enter the following information:

Using configuration from /usr/local/ssl/lib/ssleay.cnf

The pass phrase entered here is the phrase that you chose above.

Enter PEM pass phrase: ...................

You are about to be asked to enter information that will be incorporated into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank.

Country Name (2 letter code) [US]: US
State or Province Name (full name) [State]: Your State
Locality Name (eg, city) [City]: Your Town
Organization Name (eg, company) [Organization]: Your Company name
Organizational Unit Name (eg, section) [Division]: IT Department

It is important that your Common Name matches the name that the server will identify itself as when serving requests. Enter that server name below. For example, if you will be pointing people at https://secure.example.com/ then your server name would be secure.example.com. If your server has a real name ("adonis") and an alias ("secure" or "www") and you will be pointing people at the alias, then make sure you give the alias here, otherwise the browser will claim that the site name does not match the certificate.

It is also important that you give your State name, City name and two-letter UPPER CASE country code. The Organizational Unit field is optional.

Common Name (eg, YOUR name) [www.servername.com]: secure.example.com
Email Address [webmaster@servername.com]: webmaster@example.com

Using configuration from /usr/local/ssl/lib/ssleay.cnf

Certificate Request:

Data:

Version: 0 (0x0)
Subject: C=US, ST=NH, L=Your Town, O=Your Company Name
OU=IT Department, CN=secure.example.com/Email=webmaster@example.com

Subject Public Key Info:
    Public Key Algorithm: rsaEncryption
    RSA Public Key: (512 bit)
        Modulus (512 bit):
            00:c0:34:7e:a5:02:f7:35:8e:42:7b:ce:69:e9:31:
            c0:4e:fd:d2:a7:6e:2f:ee:0b:09:84:00:b5:dc:49:
            3c:36:0b:82:74:7b:c8:65:3b:c4:85:b1:f8:71:86:
            78:71:39:7c:03:16:c0:2b:50:d4:f1:dd:2a:f2:ce:
            f3:68:35:d7:43
        Exponent: 65537 (0x10001)
Signature Algorithm: md5WithRSAEncryption
40:26:58:76:fe:a5:69:ab:fe:fd:f6:6e:0d:3b:f8:79:06:7e:
96:e3:1f:e0:44:12:c1:51:c6:58:f8:38:85:92:67:4e:99:ba:
3e:55:42:94:31:94:50:ba:96:19:4e:31:4a:d4:39:d6:91:12:
10:64:20:38:9c:df:df:ea:c8:72

Webmaster email:  webmaster@example.com

Webmaster phone:  +1.603.555.1212

Mailing the CSR to your personal email account will allow you to easily cut and paste the request into the submission form. Please enter that address below.

Send CSR via Email to? -->  yourmail@example.com

Certificate request sent to yourmail@example.com.

SSLeay

These instructions assume that SSLeay is installed, and that you have the executable ssleay in your PATH. They also assume that you are using version 0.8.1 or later... ssleay version will tell you which version you are using.

# which ssleay
# ssleay version

Generate your key:

ssleay genrsa -des3 1024 > secure.example.com.key

This command sequence will generate a private key and store it in the file secure.example.com.key. It will ask you for a pass phrase: use something secure and remember it.

Your certificate will be useless without the key.

If you don't want to protect your key with a pass phrase (only if you absolutely trust that server, and you make sure the permissions are carefully set so only you can read that key) you can leave out the -des3 option.

Generate your CSR:

ssleay req -new -key secure.example.com.key> secure.example.com.csr

This command sequence will prompt you for the attributes of your certificate.

Once completed, you will have a private key in secure.example.com.key and a CSR in secure.example.com.csr. Paste the CSR into our forms, and hold on to your key. You will need the key to operate your secure server when we issue your certificate.

Cobalt Raq and XTR

To generate the key and CSR for Cobalt Raq.

1. Select Server Management > Security > SSL.

   The Certificate Information for Server Desktop screen appears along with its associated buttons

2. To create a new self-signed certificate, click Create Self-Signed Certificateand configure the selections as follows:
   • City. The city in which the organization is located or registered.
   • State or Province. The state, province, or region in which the above city is located.
   • Country. Select the country in which the organization that will use this certificate is located or registered.
   • Organization. The official name of the organization owning this certificate.

     Note: In order to obtain a signed certificate from a certificate authority, the organization name and location must be verifiable with a local, regional, or national government or other official organization. In addition, the certificate authority must be able to verify that the person requesting the certificate is the owner or employee of the named organization.

   • Organization Unit. The division or unit of the organization that is using this certificate. This is optional, but may be useful if the person applying for a signed certificate is an employee of a subsidiary of a larger organization.
   • Contact Email. The email address to be contacted for information about this certificate.
   • Certificate Expiration Date. The date after which the certificate should no longer be considered valid by client software attempting to connect to this server.
3. Click Create Signing Request to create a certificate signing request.
4. After the fields are filled in, activate the Generate Self-Signed Certificate checkbox. This allows you to generate a self-signed certificate along with the signing request. The self-signed certificate can be used temporarily while you wait for the Certificate Authority to process your signing request. The certificate signing request can be submitted to a Certificate Authority to create a signed certificate that Web browsers can verify as authentic.
5. Click Manage Certificate Authorities to add or remove secondary certificate authorities for this site. The Certificate Authority Management for Server Desktop screen appears.

   Note: Secondary certificate authorities are usually not needed, but certain authorities issue an extra certificate to be used for client authentication in addition to the usual server certificate that most certificate authorities issue.

6. Configure the settings as follows:
   • Certificate Authority Name. Enter a unique name to identify this secondary certificate authority.
   • Select Certificate. Click Browse to select the file that contains the certificate authority's certificate. The certificate should be the only thing in the file.
7. Click Import to import a signed certificate.
8. Click Browse to select the text file containing the certificate to import.

   The certificate file must contain both the private key and certificate sections if you are transferring it from another server. If the certificate is from a certificate authority to which you submitted a certificate signing request generated by this server, only the certificate is necessary, but it is okay if a private key is included with the signed certificate.

9. Click Export to download the current private key and certificate, so the certificate can be transferred to another server.

To generate the key and CSR for Cobalt XTR.

C2Net Stronghold Web Server

1. Enter the Stronghold Configuration Manager.
2. Select New Key Generation to create a new key file.
3. Enter key size (either 512 or 1024 bits) and follow instructions for generating the random data. 1024 bits is the recommended key size.

   Note: The encryption key size (512 bit, 1024 bit) has nothing to do with the actual session key (128 bit, 40 bit)

4. Enter the DN (Distinguished Name) Field information.

   The following characters can not be accepted: < > ~ ! @ # $ % ^ * / \ ( ) ? . &

   DN Field	Explanation	Example
   Country Name	The two-letter ISO abbreviation for your country	US = United States
   State or Province Name	The state or province where your organization is located. Cannot be abbreviated.	New Hampshire
   City or Locality	The city where your organization is located.	Manchester
   Organization	The exact legal name of your organization. Do not abbreviate your organization name.	My Great Company, Inc.
   Organizational Unit	Optional for additional organizational information.	Marketing
   Common Name	The FQDN (fully qualified domain name) for your web server. You will get a certificate name check warning if this is not an exact match.	secure.example.com
   SA E-mail Address	The e-mail address for the Server Administrator (optional)	admin@example.com

5. The key pair will be generated and saved in the file: strongholdserverroot/private/hostname.key.

   example: /usr/local/stronghold/private/secure.example.com.key
   

6. Edit this file to extract the CSR data to paste into the form. This is the text beginning with "-----BEGIN NEW CERTIFICATE REQUEST-----" up to and including the text "-----END NEW CERTIFICATE REQUEST-----".

Note: See also C2Net's documentation on key generation and installation instructions for both STRONGHOLD 2.3 and STRONGHOLD 2.4.x .

IBM HTTP Server

iPlanet 4.x

To activate the SSL protocol for your server, you will need to perform the procedures outlined in the following sections:

• Create a New Server Instance
• Create a Certificate Trust Database
• Requesting a Certificate
• Installing and Managing Certificates

Create a New Server Instance

1. Access the Enterprise Administration Server and choose the Servers tab.
2. Click the Add Server link.
3. Enter the desired information for the specified fields.

Create a Certificate Trust Database

A certificate database is a key-pair and certificate database installed on the local host. When you use an internal token, the certificate database is the database into which you install the key and certificate. In Enterprise Server 4.0, each server instance (including the Enterprise Administration Server) has its own certificate/key pair which is referred to as a trust database.

A key-pair file contains both the public and private keys used for SSL encryption. You use the key-pair file when you request and install a certificate. The key-pair file is stored encrypted in the following directory:

server_root/alias/<alias>-key.db

When you create the key, you specify a password that you later use when you request the certificate and when you start a server that is using encrypted communications.

To create the certificate trust database, perform the following steps:

1. Access the Enterprise Administration Server and choose the Security tab.
2. Select the desired cryptographic module (the PKCS#11 cryptographic module is the default).
3. Type the password in Database Password.
4. Re-type the password in Password (again).
5. Click OK.

If no database exists, Enterprise Server creates the proper key and certificate database files and stores them in the alias/ directory (otherwise, Enterprise Server displays an error message).

Requesting a Certificate

1. Access the Enterprise Administration Server and choose the Security tab.
2. Click the Request Certificate link.
3. In the form that Enterprise Server displays, specify if this is a new certificate or a renewal.
4. Perform the following steps to specify how you want to submit the request for the certificate:
   1. If the CA expects to receive the request in an email message, check CA Email and enter the email address of the CA. For a list of CAs, click List of available certificate authorities.
   2. If you are requesting the certificate from an internal CA that is using Netscape Certificate Server, click CA URL and enter the URL for the Certificate Server. This URL should point to the certificate servers' program that handles certificate requests. A sample URL might be: https://CA.mozilla.com:444/cms.
5. From the drop-down list, select the cryptographic module for the key-pair file you want to use when requesting the certificate.
6. Type the password for your key-pair file. This is the same password you specified when you created the trust database in Creating a Certificate Trust Database. The server uses the password to get your private key and encrypt a message to the CA. The server then sends both your public key and the encrypted message to the CA. The CA uses the public key to decrypt your message.
7. Type your identification information. The information required is listed as follows:
   • Common Name must be the fully qualified hostname used in DNS lookups (for example, secure.example.com). This is the hostname in the URL that a browser uses to connect to your site. It's important that these two names are the same, otherwise a client is notified that the certificate name doesn't match the site name, which will make people doubt the authenticity of your certificate.
   • Organizational Unit is field that describes an organization within your company. This can also be used to note a less formal company name (without the Inc., Corp., and so on).
   • Locality is an field that usually describes the city, principality, or country for the organization.
   • State or Province is usually required, but can be optional for some CAs. Note that most CAs won't accept abbreviations, but check with them to be sure.
   • Country is a required, two-character abbreviation of your country name (in ISO format). The country code for the United States is US.

   All this information is combined as a series of attribute-value pairs called the distinguished name (DN), which uniquely identifies the subject of the certificate.

8. Double-check your work to ensure accuracy. The more accurate the information, the faster your certificate is likely to be approved.
9. Click OK once you've checked that the information is correct.

Installing and Managing Certificates

To install the issued Certificate, please refer to the following solution: vs26896

iPlanet 6.x

Lotus Domino Go server

Ensim server

Open the Apache web server manager

1. Select SSL settings
2. At the bottom of the form select Generate
3. Enter the CSR information

   When creating a CSR you must follow these convention. Ente rthe inforamtion to be displayed in the certificate. The following characters cannot be accepted: < > ~ ! @ # $ % ^ * / \ ( ) ? . , &

   • Common Name - the FQDN of your server (secure.example.com)
   • Organization - your company name (Your Company, Inc.)
   • Organization Unit - an optional internal unit name (IT Department)
   • City or Locality - your city (Manchester)
   • State or Province - your state (New Hampshire)
   • Country - the ISO two character code for your country (US)
4. Click Save
5. The SSL window will then display the certificate request in an encrypted format.
6. Submit your CSR

Microsoft IIS 4.0

WARNING: Microsoft IIS 4.0 has serious issues with CSRs for SSL certificates. Please refer to the thawt article on SSL and IIS 4

Microsoft IIS 5.0

WARNING: Microsoft IIS 4.0 has serious issues with CSRs for SSL certificates. Please refer to the thawt article on SSL and IIS 5

Netscape Commerce

1. After you have installed Netscape Commerce server, start up the admin server and connect to it.
2. Select the server you want to run in secure mode and you will be presented with a page entitled "Netscape Server Manager - Commerce Server".
3. Under "Security Configuration" there is a link called "generate a key".
4. Select it and follow the instructions. This creates your private key. Next, select "request a certificate" to generate a CSR.
5. In the space where it asks for a Certificate authority enter your own email address.
6. A copy of the CSR will be mailed to you by the server - you can keep this for future reference.

When you have completed the form, submit it. The resulting page gives you your CSR. It looks like this:

-----BEGIN CERTIFICATE REQUEST-----
MIIBujCCASMCAQAwejELMAkGA1UEBhMCQ0ExEzARBgNVBAgTClRFc3QgU3RhdGUx
ETAPBgNVBAcTCENvbG9yYWR0MRswGQYDVQQKExJDYW5hZGlhbiBUZXN0IE9yZy4x
EjAQBgNVBAsTCU9VIE9mZmljZTESMBAGA1UEAxMJd3d3LmV4LmNhMIGfMA0GCSqG
SIb3DQEBAQUAA4GNADCBiQKBgQD5PIij2FNa+Zfk1OHtptspcSBkfkfZ3jFxYA6y
po3+YbQhO3PLTvNfQj9mhb0xWyvoNvL8Gnp1GUPgiw9GvRao603yHebgc2bioAKo
TkWTmW+C8+Ka42wMVrgcW32rNYmDnDWOSBWWR1L1j1YkQBK1nQnQzV3U/h0mr+AS
E/nV7wIDAQABoAAwDQYJKoZIhvcNAQEEBQADgYEAAAhxY1dcw6P8cDEDG4UiwB0D
OoQnFb3WYVl7d4+6lfOtKfuL/Ep0blLWXQoVpOICF3gfAF6wcAbeg5MtiWwTwvXR
tJ2jszsZbpOuIt0WU1+cCYivxuTi18CQNQrsrD4s2ZJytkzDTAcz1Nmiuh93eqYw
+kydUyRYlOMEIomNFIQ=
-----END CERTIFICATE REQUEST-----

Copy your CSR from that page, and save it for future reference.

O'Reilly Website Professional

1. Open the Server Properties console
2. Select KEY RING tab
3. Click on NEW KEY PAIR to open the Certificate wizard, and then enter your web site information in the forms provided. You will also need to generate your Private Key and Request.
4. Your new certificate request will be in a new .pern file or your Windows clipboard. copy the contents of this file from the "-----BEGIN CERTIFICATE REQUEST-----" up to and including the "-----END CERTIFICATE REQUEST-----"

   Note: Do not "click here to choose certificate authority".

4D Webstar Server Suite

Generate a Key Pair

Zeus Server

Zeus Server allows each of your virtual servers to have their own SSL certificates. This allows multiple secure sites to run on the same Zeus server. Each virtual server requires its own public and private certificates for secure communication. Secure certificates are added to a virtual server by clicking on the SSL Configuration link from the Edit Server page. The easiest way to configure SSL on your virtual server is to use the 'SSL Quick Setup' wizard. Click the 'SSL Quick Setup' button and fill in the form

You can configure your SSL server manually. You can use the certificate tool ($ZEUSHOME/admin/bin/cert) or an equivalent tool like openssl to generate the keys and certificates.

Generating a private key

# $ZEUSHOME/admin/bin/cert -new -type private -keysize 1024 -out private.key
Generating keys, this may take a few seconds
Your new private key has been written to 'private.key'

Generating a certificate request

# $ZEUSHOME/admin/bin/cert -new -type request -key private.key -out cert.csr
The following information is required to make up the certificate.
Optional fields can be left blank by entering a '.'
Country: GB
State/Province (optional outside US): .
Locality (town/city): Cambridge
Organisation: Zeus
Organisational Unit (optional): .
Common Name (full DNS name of the machine): secure.example.com
Your certificate request has been written to the file 'cert.csr'.

Generating a public certificate

# $ZEUSHOME/admin/bin/cert -new -type public -key private.key -out public.cert
The following information is required to make up the certificate.
Optional fields can be left blank by entering a '.'
Country: GB
State/Province (optional outside US): .
Locality (town/city): Cambridge
Organisation: Zeus
Organisational Unit (optional): .
Common Name (full DNS name of the machine): secure.example.com
Your new public certificate has been written to the file 'public.cert'.

Displaying the public certificate

# $ZEUSHOME/admin/bin/cert -in public.cert -text
X509 Certificate:
Certificate Info:
Version: 00
Serial Number: 00
Signature Algorithm: md5withRSAEncryption
Issuer:
C=UK, L=Cambridge, O=Zeus, CN=atlas
Validity:
Not Before: Mon, 15 May 2000 17:40:11 GMT
Not After: Tue, 15 May 2001 17:40:11 GMT
Subject:
C=GB, L=Cambridge, O=Zeus, CN=www.zeus.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryptionPublic Key:
Modulus:
c4:84:c7:63:36:e0:d4:52:fb:41:44:31:38:9b:91:5e:62:
....
Exponent:
01:00:01
Signature Algorithm:
md5withRSAEncryption
Signature:
29:eb:c2:62:73:b8:b7:82:94:33:1f:da:9b:83:39:8b:75:1c:47:f5:41: ....

Verifying Key/Certificate pairs

# $ZEUSHOME/admin/bin/cert -check -key private.key -in public.cert

© 1998-2008  Dynamic Network Services, Inc.  -  Legal Notices  -  Contacts