Generate Key And Crt File Apache Openssl
How do I make my own bundle file from CRT files?
Answer: You may do this using you favorite text editor or by using the command line.
Example:
# Root CA Certificate - AddTrustExternalCARoot.crt
# Intermediate CA Certificate 1 - ComodoRSAAddTrustCA.crt OR ComodoECCAddTrustCA.crt
# Intermediate CA Certificate 2 - ComodoRSADomain/Organization/ExtendedvalidationSecureServerCA.crt OR ComodoRSAECCDomain/Organization/ExtendedvalidationSecureServerCA.crt
# Intermediate CA Certificate 3 - ComodoSHA256SecureServerCA.crt
# Your SSL Certificate - yourDomain.crt
Note: You will not need your SSL certificate for this exercise.
GUI Text Editor
1. Open All files in a text editor. (Remember, not your domain certificate.)
2. Create a new blank text file.
3. Copy contents of all files in reverse order and paste them into the new file.
Example: Intermediate 3, Intermediate 2, Intermediate 1, Root Certificate.
4. Save newly created file as 'yourDomain.ca-bundle'.
Command Line
Linux or UNIX-like Operating Systems:
-- cat ComodoRSAAddTrustCA.crt ComodoRSADomain/Organization/ExtendedvalidationSecureServerCA.crt AddTrustExternalCARoot.crt > yourDomain.ca-bundle
$ openssl req -new -x509 -nodes -sha1 -days 365 -key server.key -out server.crt -extensions usrcert This signs the server CSR and results in a server.crt file. You can see the details of this Certificate using: $ openssl x509 -noout -text -in server.crt; How can I change the pass-phrase on my private key file?
- Generating a Certificate Signing Request (CSR) using OpenSSL (Apache & modssl, NGINX) A CSR is a file containing your certificate application information, including your Public Key. Generate your CSR and then copy and paste the CSR file into the web form in the enrollment process.
- The certificate is made out of your public key. The public and private keys are completely separate (by definition) and you can't generate one from the other. How was this new.crt file generated? There just has to be a key file and a CSR somewhere! – Alexios Jan 7 '14 at 10:00.
- See Example: SSL Certificate - Generate a Key and CSR. Tableau Server uses Apache, which includes OpenSSL. You can use the OpenSSL toolkit to generate a key file and Certificate Signing Request (CSR) which can then be used to obtain a signed SSL certificate.
- Oct 17, 2017 In this case, we need to export the SSL certificates from the Windows server and store to.pfx file. After that, we need to copy this.pfx (PKCS#12/)file to the Linux server and convert that file to an Apache-compatible file format like individual certificate, CA bundle and private key files and use it.
- Follow these instructions to generate a certificate signing request (CSR) for your Apache Web server. When you have completed generating your CSR, cut/copy and paste it into the CSR field on the SSL certificate-request page.
Or
Generate rsa key pair c. -- cat ComodoSHA256SecureServerCA.crt AddTrustExternalCARoot.crt > yourDomain.ca-bundle
Windows or DOS:
-- copy ComodoRSAAddTrustCA.crt + ComodoRSADomain/Organization/ExtendedvalidationSecureServerCA.crt + AddTrustExternalCARoot.crt yourDomain.ca-bundle
Or
-- copy ComodoSHA256SecureServerCA.crt + AddTrustExternalCARoot.crt yourDomain.ca-bundle
Note: 'yourDomain.ca-bundle' is only a place holder file name. You may call it anything you want.
Related Items
* Root & Intermediate Certificates
These instructions are suitable for any server using ApacheSSL or Apache+mod_ssl or Apache 2. On the contrary do not apply these instructions on servers with an overlayer (Cobalt, Plesk, etc.) or Tomcat Generate a CSR for Tomcat.
New: Use our command line generator
In order to gain some time, you can now generate your command line with our CSR creation assistant tool. Just copy/paste to finalize !
To install a certificate on Apache Windows, you will need a cryptographic tool to generate the private key and the CSR. To do so, you can use 'OpenSSL':Install OpenSSL on a Windows computer
1- Generate the private key
- Connect under
rootand access the setup directory of your Apache server.
It is often: - We'll place our working files here but you can choose an other repertory.
- Choose a file's name that fits you and generate the key with the following command:
- If you want this key to be protected by a password (that will be requested any time you'll restart Apache), add:
'-des3'after 'genrsa'. - You can also enhance the quality of your key. To do so, add the instructions below after 'genrsa':
'-rand/var/log/messages'.
It enables random numbers to be used.
Make a backup copy of the .key file!
- Protect your file with:
2- Create your certificate request (CSR)
- Use this command to generate the CSR:
- The system will then ask you to fill in fields. To do so respect instructions of the page Obtain a server certificate
Country Name (2 letter code) []: (FR in France for example)
State or Province Name (full name) [Some-State]: (your state or province name, name of your département in France)
Locality Name (eg, city) []: (the name of your city)
Organization Name (eg, company) []: (your organization name)
Organizational Unit Name (eg, section) []: (do not fill - advised - or enter a generic term such as 'IT Department'.)
Common Name (eg, YOUR name) []: (the name of the website to be secured)
Email Address []: (let blank) - Do not fill in fields such as: 'A challenge password' or 'An optional company name'
3- Finalize the order process
- Use the appropriate link to place your order on our website. See Access an order form
- Copy/paste the content of the www.example.com.csr file in the form.
Configuration and use options of OpenSSL
- To generate the CSR, OpenSSL reads openssl.cnf by default. But on some platform this file is not appropriate.
In that case you can download ours:- For Symantec or Thawte server certificates: openssl-dem-server-cert-thvs.cnf
- For TBS X509 or Sectigo server certificates: openssl-dem-server-cert.cnf
- For Certigna Server Client certificates: openssl-dem-certigna-srv-cli.cnf
- For Apache under Windows, the instructions are the same. You just need to make sure you have installed Apache with OpenSSL first.Download it here. Concerning the remaining instructions, just replaceopenssl by openssl.exe
OpenSSL and SHA256
By default, OpenSSL cryptographic tools are configured to make SHA1 signatures.
for example, if you want to generate a SHA256-signed certificate request (CSR) , add in the command line: -sha256, as in:
Useful links
- Generate your command line with our CSR creation assistant tool.