tencent cloud

Using OpenSSL to Generate Self-Signed Certificates
Download PDF
Last updated: 2025-12-09 16:57:30
Using OpenSSL to Generate Self-Signed Certificates
Last updated: 2025-12-09 16:57:30
Download PDF
All server and client certificates generally need to be applied for from an authoritative certificate authority (CA) to ensure they are trusted by different operating systems and browsers. The CA usually charges a certain fee for the certificate. If you currently only need an HTTPS certificate for testing or in-house use, you can also manually issue a self-signed certificate using OpenSSL. The steps are as follows:
RSA Algorithm Certificate
ECC Algorithm Certificate

Step 1: Generate Root Certificate

1. Generate the root certificate private key through the following command, using an RSA certificate with a 4096 key length as an example, and save the generated private key as a ca-rsa.key file.
openssl genrsa -out ca-rsa.key 4096
2. Use the above certificate private key to generate a Certificate Signing Request (CSR) file, saved as ca-rsa.csr. The following command specifies the basic information of the certificate through -subj, where:
C=CN represents the country.
ST=State represents the province.
L=City represents the city.
O= Example Org represents the organization.
OU=Example CA represents the department.
CN=Example Root CA represents the common name of the certificate. In a CA certificate, this field can describe the purpose of the CA. If it is a domain name certificate, the domain name for certificate issuance needs to be specified in this field.
openssl req -new -key ca-rsa.key -out ca-rsa.csr -subj "/C=US/ST=State/L=City/O=Example Org/OU=Example CA/CN=Example Root CA"
3. Create the root certificate public key based on the certificate signing request file, with a validity of 3650 days, and save it as ca-rsa.crt. The -extfile parameter specifies this certificate as a CA certificate.
openssl x509 -req -in ca-rsa.csr -out ca-rsa.crt -signkey ca-rsa.key -days 3650 -sha256 -extfile <(printf "basicConstraints=critical,CA:TRUE\\nkeyUsage=critical,keyCertSign,cRLSign\\nsubjectKeyIdentifier=hash\\n")
4. Issue the certificate and verify whether it is a CA certificate.
openssl x509 -in ca-rsa.crt -noout -text | grep -A2 "X509v3 Basic Constraints"
The output result contains CA:TRUE, which indicates a correct CA certificate. See the output result below:
X509v3 Basic Constraints: critical
                CA:TRUE    # Indicates the cert is a CA certificate.
            X509v3 Key Usage: critical

Step Two: Issue a Domain Name Certificate

To issue a certificate for the designated domain name www.example.com, you can use the generated CA certificate to start issuing a self-signed domain name certificate:
1. Generate the certificate private key through the following command, using an RSA certificate with a 4096 key length as an example, and save the generated private key as a rsa-domain.key file.
openssl ecparam -name secp384r1 -genkey -noout -out rsa-domain.key
2. Use the above certificate private key to generate a Certificate Signing Request (CSR) file, saved as rsa-domain.csr. The following command specifies the basic information of the certificate through -subj. Please note to replace the CN field content with the domain name you want to issue. In this example, www.example.com is used.
openssl req -new -key rsa-domain.key -out rsa-domain.csr -subj "/C=US/ST=State/L=City/O=Example Org/OU=Example CA/CN=www.example.com"
3. Sign the domain name certificate with the CA certificate, generate the public key with a validity of 3650 days, and save it as rsa-domain.crt.
openssl x509 -req -in rsa-domain.csr -out rsa-domain.crt -CA ca-rsa.crt -CAkey ca-rsa.key -days 3650
4. Compare the CA certificate with the domain name certificate public key to verify whether the certificate chain of the issued domain name certificate is correct.
openssl verify -CAfile ca-rsa.crt rsa-domain.crt
If the output result displays rsa-domain.crt:OK, it indicates that the certificate issuance chain is correct. See the following:
rsa-domain.crt: OK

Step 1: Generate Root Certificate

1. Generate the root certificate private key through the following command, using an ECC certificate with the secp384r1 encryption algorithm as an example, and save the generated private key as a ca-ecc.key file.
openssl ecparam -name secp384r1 -genkey -noout -out ca-ecc.key
2. Use the above certificate private key to generate a Certificate Signing Request (CSR) file, saved as ca-ecc.csr. The following command specifies the basic information of the certificate through -subj, where:
C=CN represents the country.
ST=State represents the province.
L=City represents the city.
O= Example Org represents the organization.
OU=Example CA represents the department.
CN=Example Root CA represents the common name of the certificate. In a CA certificate, this field can describe the purpose of the CA. If it is a domain name certificate, the domain name for certificate issuance needs to be specified in this field.
openssl req -new -key ca-ecc.key -out ca-ecc.csr -subj "/C=US/ST=State/L=City/O=Example Org/OU=Example CA/CN=Example Root CA"
3. Create the root certificate public key based on the certificate signing request file, with a validity of 3650 days, and save it as ca-ecc.crt. The -extfile parameter specifies this certificate as a CA certificate.
openssl x509 -req -in ca-ecc.csr -out ca-ecc.crt -signkey ca-ecc.key -days 3650 -sha256 -extfile <(printf "basicConstraints=critical,CA:TRUE\\nkeyUsage=critical,keyCertSign,cRLSign\\nsubjectKeyIdentifier=hash\\n")
4. Issue the certificate and verify whether it is a CA certificate.
openssl x509 -in ca-ecc.crt -noout -text | grep -A2 "X509v3 Basic Constraints"
The output result contains CA:TRUE, which indicates a correct CA certificate. See the output result below:
X509v3 Basic Constraints: critical
                CA:TRUE    # Indicates the cert is a CA certificate.
            X509v3 Key Usage: critical

Step Two: Issue a Domain Name Certificate

To issue a certificate for the designated domain name www.example.com, you can use the generated CA certificate to start issuing a self-signed domain name certificate:
1. Generate the certificate private key through the following command, using an ECC certificate with the secp384r1 encryption algorithm as an example, and save the generated private key as a ecc-domain.key file.
openssl ecparam -name secp384r1 -genkey -noout -out ecc-domain.key
2. Use the above certificate private key to generate a Certificate Signing Request (CSR) file, saved as ecc-domain.csr. The following command specifies the basic information of the certificate through -subj. Please note to replace the CN field content with the domain name you want to issue, using www.example.com as an example in this case.
openssl req -new -key ecc-domain.key -out ecc-domain.csr -subj "/C=US/ST=State/L=City/O=Example Org/OU=Example CA/CN=www.example.com"
3. Sign the domain name certificate with the CA certificate, generate the public key with a validity of 3650 days, and save it as ecc-domain.crt.
openssl x509 -req -in ecc-domain.csr -out ecc-domain.crt -CA ca-ecc.crt -CAkey ca-ecc.key -days 3650
4. Compare the CA certificate with the domain name certificate public key to verify whether the certificate chain of the issued domain name certificate is correct.
openssl verify -CAfile ca-ecc.crt ecc-domain.crt
If the output result displays ecc-domain.crt:OK, it indicates that the certificate issuance chain is correct.
ecc-domain.crt: OK

Was this page helpful?
You can also Contact Sales or Submit a Ticket for help.
Yes
No

Feedback