How to Generate SSL Certificates with OpenSSL

Quick Answer

The standard certificate workflow in four commands:

# Step 1 — Generate a private key
openssl genrsa -out server.key 2048

# Step 2 — Create a Certificate Signing Request
openssl req -new -key server.key -out server.csr

# Step 3a — Self-signed certificate (for internal use)
openssl req -x509 -key server.key -in server.csr -out server.crt -days 365

# Step 3b — Or submit the CSR to a Certificate Authority
# The CA will return a signed .crt file

Key Concepts

Before running commands, it helps to understand what each file type is.

Private Key (.key or .pem)
A secret file generated on your server. It must never leave the server. Everything else (CSR, certificate) is derived from it.

Certificate Signing Request (.csr)
A file you generate from your private key. It contains your identity information (domain name, organization, country) and your public key. You submit this to a Certificate Authority (CA) to get a signed certificate.

Certificate (.crt or .pem)
The signed file returned by a CA, or generated locally as self-signed. This is what your web server presents to clients.

Certificate Authority (CA)
A trusted entity (Let’s Encrypt, DigiCert, or your own internal CA) that verifies your identity and signs your certificate. Browsers and operating systems trust certificates signed by known CAs.

Generating a Private Key

openssl genrsa -out server.key 2048

openssl genrsa -out server.key 4096

openssl genrsa -out server.key -aes256 2048

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-384 -out server.key

Creating a Certificate Signing Request (CSR)

A CSR contains your public key and identity fields known as the Subject Distinguished Name (DN).

Interactive CSR (prompts for each field)

openssl req -new -key server.key -out server.csr

OpenSSL will ask for:

Non-interactive CSR (with -subj flag)

Useful for scripting and automation:

openssl req -new -key server.key -out server.csr \
  -subj "/C=US/ST=California/L=San Francisco/O=ACME Corp/CN=server.example.com"

Generate Key and CSR in One Step

openssl req -new -newkey rsa:2048 -nodes -out server.csr \
  -subj "/CN=server.example.com"

The -nodes flag means “no DES” — the key will not be encrypted.

Inspecting a CSR

Always verify a CSR before submitting it to a CA:

openssl req -in server.csr -noout -text

Check these fields in the output:

• Subject — verify domain name (CN) is correct
• Public Key Algorithm — RSA or EC
• Key Size — should be 2048 or higher for RSA

Generating a Self-Signed Certificate

Self-signed certificates are useful for:

• internal services and intranets
• development and testing environments
• internal CA infrastructure

openssl req -x509 -key server.key -in server.csr -out server.crt -days 365

openssl req -x509 -newkey rsa:2048 -nodes \
  -keyout server.key -out server.crt -days 365 \
  -subj "/CN=server.example.com"

Signing with a Certificate Authority

If you have a certificate from a CA (Let’s Encrypt, internal PKI, etc.), the workflow is:

1. Generate your private key
2. Generate a CSR
3. Submit the CSR to the CA
4. Receive the signed .crt file back
5. Install both the .key and .crt on your server

For internal CA environments (Windows CA or OpenSSL CA), you submit the CSR through your organization’s CA interface or CLI.

Inspecting Certificates

openssl x509 -in server.crt -noout -text

# Validity dates
openssl x509 -in server.crt -noout -dates

# Subject and Issuer
openssl x509 -in server.crt -noout -issuer -subject

# Subject Alternative Names (SANs)
openssl x509 -in server.crt -noout -ext subjectAltName

openssl rsa -in server.key -noout -modulus
openssl x509 -in server.crt -noout -modulus

openssl ec -in server.key -pubout
openssl x509 -in server.crt -noout -pubkey

File Formats: PEM, DER, PFX

OpenSSL works with three common certificate formats.

openssl x509 -in server.crt -outform DER -out server.der

openssl x509 -in server.der -inform DER -out server.crt

openssl pkcs12 -export -in server.crt -inkey server.key -out server.pfx

openssl pkcs12 -in server.pfx -out server.key -nodes -nocerts

openssl pkcs12 -in server.pfx -out server.crt -nodes -clcerts

Tips and Common Mistakes

Mismatched key and certificate
The most common issue when installing certificates. Always verify the modulus (RSA) or publi key (EC) matches between your .key and .crt files before deploying.

Wrong Common Name
The CN must exactly match the hostname users will access. For multi-domain certificates, use Subject Alternative Names (SANs), not multiple CNs.

Expired certificates
Always check validity dates before deploying:

openssl x509 -in server.crt -noout -dates

Private key with passphrase on automated services
If your key is encrypted and your web server can’t start automatically after a reboot, remove the passphrase:

openssl rsa -in encrypted.key -out server.key

Wrong file format for the target platform
Linux services expect PEM. Windows IIS typically expects PFX. Java keystores use JKS or DER.
Always check what format the target platform requires.

File permissions on private keys
Private key files must be readable only by the service account. On Linux:

chmod 600 server.key

Related Tools

• OpenSSL Commands Cheat Sheet — quick reference for all common OpenSSL commands

Related Guides

• What is a Certificate Authority and how PKI works
• How to install an SSL certificate on Nginx
• How to install an SSL certificate on Apache
• How to renew certificates with Let’s Encrypt (Certbot)
• How to manage certificates in Windows Certificate Store