中文
devexamples
← Recipes

阅读中文版本

Generate a CSR and Key with OpenSSL

Create a private key, generate a CSR with the correct subject and SANs, verify it, and keep the key protected so a certificate can be issued cleanly.

~30 mintlspkisecurity

Task

Produce a certificate signing request with SANs and a protected private key for a CA.

When to use this

A CSR is generated with the wrong SANs or an unprotected key, so the certificate does not cover the hostname or the key is exposed.

Prerequisites

  • OpenSSL installed
  • Knowledge of the exact hostnames to include

Steps

1. Generate a modern private key and set restrictive permissions.

Expected output: The key is not world-readable.

2. Create a CSR with a subject and a SAN extension listing every hostname.

Expected output: The CSR covers all required names.

3. Verify the CSR contents and signature before sending.

Expected output: The request is correct and intact.

4. Submit the CSR to the CA and never share the private key.

openssl req -new -key app.key -config san.cnf -out app.csr

Expected output: Only public material leaves the server.

Troubleshooting

Problem

Certificate missing a hostname

Solution

Modern clients ignore CN and use SAN; list every name in subjectAltName.

Problem

Key permissions too open

Solution

Set umask or chmod 600 on the key immediately after creation.

Limitations

  • The CSR contains public information; the private key must never be included or transmitted.
  • SAN syntax errors cause silent coverage gaps that only appear at connection time.

Context

Produce a certificate signing request with SANs and a protected private key for a CA. A CSR is generated with the wrong SANs or an unprotected key, so the certificate does not cover the hostname or the key is exposed.

Steps

  1. Generate a modern private key and set restrictive permissions. Expected: The key is not world-readable.
  2. Create a CSR with a subject and a SAN extension listing every hostname. Expected: The CSR covers all required names.
  3. Verify the CSR contents and signature before sending. Expected: The request is correct and intact.
  4. Submit the CSR to the CA and never share the private key. Expected: Only public material leaves the server.
# san.cnf
[req]
distinguished_name = dn
req_extensions = v3_req
[v3_req]
subjectAltName = @alt
[alt]
DNS.1 = app.example.com
DNS.2 = www.app.example.com
# command
openssl req -new -newkey rsa:3072 -nodes -keyout app.key \
  -config san.cnf -out app.csr
chmod 600 app.key

Verify

  • The key is not world-readable.
  • The CSR covers all required names.
  • The request is correct and intact.
  • Only public material leaves the server.

Limits

  • The CSR contains public information; the private key must never be included or transmitted.
  • SAN syntax errors cause silent coverage gaps that only appear at connection time.