How to Generate SSL/TLS Certificates with OpenSSL: Step‑by‑Step Guide

Tool Introduction

OpenSSL is an implementation tool for the SSL/TLS protocol.

key is a private key file used to encrypt data sent to the client and decrypt data received from the client.

csr is a Certificate Signing Request file submitted to a Certificate Authority (CA) for certificate signing.

crt is the certificate signed by the CA or a self‑signed certificate, containing the holder’s information, public key, and the signer’s signature.

Operation Steps

1. Generate Certificate

Generate private key

openssl genrsa -des3 -out myCA.key 2048
## openssl genrsa generates an RSA private key; the public key is derived from it
## -des3 specifies the encryption method
## 2048 is the key length
## Adding -nodes disables encryption, avoiding the need to remove the password later

Remove the password from the private key openssl rsa -in myCA.key -out myCA.key Generate PEM file

openssl req -utf8 -x509 -new -nodes -key myCA.key -sha256 -days 825 -out myCA.pem

2. Create CA‑signed Certificate

Generate private key openssl genrsa -out server.key 2048 Create Certificate Signing Request

openssl req -new -key server.key -out server.csr
## Common Name should match the domain name to avoid browser warnings

Create an extension configuration file

cat > server.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = www.baidu.com # Include the domain name here because Common Name alone is often ignored
DNS.2 = www.sougou.com # Optional additional domain
IP.1 = 192.168.1.1  # Optional IP address if needed
EOF
## Chrome checks that the current domain appears in the certificate’s subjectAltName field

Create the signed certificate

openssl x509 -req -in server.csr -CA myCA.pem -CAkey myCA.key -CAcreateserial -out server.crt -days 3650 -sha256 -extfile server.ext

Resulting certificate files

server.crt

server.key