tencent cloud

PrevNext

Feedback

search by keyword

Recent Pages

Documentation
Tencent Cloud EdgeOne
    Documentation
    Download PDF

    Using OpenSSL to Generate Self-Signed Certificates

    Last updated: 2024-12-19 11:03:27
    Download PDF
      All server and client certificates usually need to be applied for from a certificate authority (CA) to ensure that they can be trusted by different operating systems and browsers. CA typically charges a certain certificate fee. If you currently need an HTTPS certificate just for testing or for internal use in an enterprise, you can also issue a self-signed certificate using OpenSSL. Refer to the following steps:

      Step 1: Generating a Root Certificate

      1. Create a root certificate private key with the following command, which will generate a 2048-bit private key and save it to a .key file.
      openssl genrsa -out root.key 2048
      2. Generate a Certificate Signing Request (CSR) file based on the root certificate private key.
      openssl req -new -key root.key -out root.csr
      During the generation of a CSR file, you need to provide information such as the organization name and common name, which can be filled in based on the actual usage.
      3. Run the following command to create a root certificate.
      openssl x509 -req -in root.csr -out root.crt -signkey root.key -CAcreateserial -days 3650
      You will get a root certificate, root.crt, with a validity period of 10 years. You can use this root certificate to issue the required server and client certificates later.

      Step 2: Issuing a Certificate

      Taking issuing a server certificate as an example, you can start issuing your own certificates using the root certificate generated in Step 1:
      1. Generate a private key for the server certificate.
      openssl genrsa -out server.key 2048
      2. Generate a CSR file based on the server certificate private key.
      openssl req -new -out server.csr -key server.key
      During the generation of a CSR file, similar to that for the root certificate, you need to provide information such as the organization name and common name, which can be filled in based on the actual usage.
      3. Generate a server public key certificate.
      openssl x509 -req -in server.csr -out server.crt -signkey server.key -CA root.crt -CAkey root.key -CAcreateserial -days 3650
      
      Through the above three steps, you will obtain self-signed server certificates, server.crt, and server.key, with a validity period of 10 years. You can repeat these steps to continue generating other required server or client certificates using the same root certificate.
      
      
      
      Contact Us

      Contact our sales team or business advisors to help your business.

      Contact Us
      Technical Support

      Open a ticket if you're looking for further assistance. Our Ticket is 7x24 avaliable.

      Submit a Ticket
      7x24 Phone Support
      Copyright © 2013-2024 Tencent Cloud. All Rights Reserved.
      Privacy PolicyLegalCookie Policy