Generate self signed SSL certificate -

Follow below steps to generate self signed certificate:

You need to first generate your own private key.

    $ openssl genrsa -des3 -out server.key 1024

    Generating RSA private key, 1024 bit long modulus
    .......................++++++
    .......++++++
    e is 65537 (0x10001)
    Enter pass phrase for server.key:
    Verifying - Enter pass phrase for server.key:

With above command it will generate private key, while doing that it will ask you to enter pass phrase which will make this private key useful who knows this pass phrase. This will generate the private server key server.key.

Then you need to generate Certificate Signing Request.

    $ openssl req -new -key server.key -out server.csr

    Enter pass phrase for server.key:
    You are about to be asked to enter information that will be incorporated
    into your certificate request.
    What you are about to enter is what is called a Distinguished Name or a DN.
    There are quite a few fields but you can leave some blank
    For some fields there will be a default value,
    If you enter '.', the field will be left blank.
    -----
    Country Name (2 letter code) [AU]:IN
    State or Province Name (full name) [Some-State]:Maharashtra
    Locality Name (eg, city) []:Pune
    Organization Name (eg, company) [Internet Widgits Pty Ltd]:Pandurang Patil Pvt. Ltd.
    Organizational Unit Name (eg, section) []:Pune
    Common Name (e.g. server FQDN or YOUR name) []:www.pandurangpatil.com    
    Email Address []:[email protected]

    Please enter the following 'extra' attributes
    to be sent with your certificate request
    A challenge password []:
    An optional company name []:

Here you need to enter required details, you can refer above request output. You may chose to skip last to questions. This step will generate the certificate signing request server.csr.

To self sign the certificate we need to create signing certificate as well (that is your own CA certificate). For that you need to first create private key for CA.

    $ openssl genrsa -des3 -out ca.key 1024
    Generating RSA private key, 1024 bit long modulus
    .......................++++++
    .......++++++
    e is 65537 (0x10001)
    Enter pass phrase for ca.key:
    Verifying - Enter pass phrase for ca.key:

This private key pass phrase will be required to be used while signing the Certificate Signing Request.

Now we have to generate CA certificate

    $ openssl req -new -x509 -days 365 -key ca.key -out ca.crt

    Enter pass phrase for ca.key:
    You are about to be asked to enter information that will be incorporated
    into your certificate request.
    What you are about to enter is what is called a Distinguished Name or a DN.
    There are quite a few fields but you can leave some blank
    For some fields there will be a default value,
    If you enter '.', the field will be left blank.
    -----
    Country Name (2 letter code) [AU]:IN
    State or Province Name (full name) [Some-State]:Maharashtra
    Locality Name (eg, city) []:Pune
    Organization Name (eg, company) [Internet Widgits Pty Ltd]:Pandurang Patil CA
    Organizational Unit Name (eg, section) []:Pune
    Common Name (e.g. server FQDN or YOUR name) []:www.pandurangpatil.com
    Email Address []:[email protected]

Now we have to sign .csr request that we have generated in step 2. For that we need to provide .conf file through which utility will take required inputs. Somebody has created this nice script which will automate next steps to sign .csr request. You can download this .sh file on your machine, I am assuming it will be saved as sign.sh at the same location from where you are executing above commands. Make this sign.sh executable.

    $ ./sign.sh server.csr

    CA signing: server.csr -> server.crt:
    Using configuration from ca.config
    Enter pass phrase for ./ca.key:
    Check that the request matches the signature
    Signature ok
    The Subject's Distinguished Name is as follows
    countryName           :PRINTABLE:'IN'
    stateOrProvinceName   :PRINTABLE:'Maharashtra'
    localityName          :PRINTABLE:'Pune'
    organizationName      :PRINTABLE:'Pandurang Patil Pvt.Ltd.'
    organizationalUnitName:PRINTABLE:'Pune'
    commonName            :PRINTABLE:'www.pandurangpatil.com'
    emailAddress          :IA5STRING:'[email protected]'
    Certificate is to be certified until Mar  6 09:52:59 2015 GMT (365 days)
    Sign the certificate? [y/n]:y


    1 out of 1 certificate requests certified, commit? [y/n]y
    Write out database with 1 new entries
    Data Base Updated
    CA verifying: server.crt <-> CA cert
    server.crt: OK

While signing you need to enter pass phrase for ca.key and confirm the details. This step will generate server.crt. This way you have your private key server.key and self signed certificate sever.crt generated.

SelfSigned SSL

See also