Generating A Certificate Signing Request; Generating A Self-Signed Certificate; Creating The Certificate Package - IBM TS4300 User Manual

IBM Confidential

Generating a certificate signing request

The req command is used to generate a CSR. The most basic form of this command specifies the name
of the key file you created in the previous step and the name of the output file, which must have a *.csr
extension.
The following example also includes the -SHA256 option, which creates a certificate using the SHA256
signature algorithm.
• Windows
OpenSSL> req -new -key key-filename.pem -out cert.csr -SHA256
• Linux
$ openssl req -new -key key-filename.pem -out cert.csr -SHA256
When you enter the command, you will be prompted to provide the following information. This
information is used to create a distinguishing name (DN) for the certificate.
• The two-letter code for your country, such as US or DE
• The full name of your state or province
• Your city or town
• The name of your organization
• The name of the unit within your organization
• Your name or the host name of the system
• Your email address
• A challenge password – This is not related to the password you assigned when creating the private key.
Leave blank unless you understand when and how to use it.
• Company name – Optional

Generating a self-signed certificate

The req command is also used to generate a self-signed certificate. The output file should have a *.pem
extension.
• Windows
Openssl> req -new -x509 -key key-filename.pem -out selfcert.pem -SHA256
• Linux
$ openssl req -new -x509 -key key-filename.pem -out selfcert.pem -SHA256

Creating the certificate package

When you have the certificate, copy and paste the contents of the certificate file into the file containing
the private key. It should look something like the following (only much longer). The file must have a *.pem
extension.
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-256-CBC,F6F1F37584D8189C97F23F9DCD431B42
qwabUGR9ag09wq1nDtsB3hSuXtJdOBhEn3Wok6qrIWqE8VL8Ss5N7U4MNIWA4G9A ...
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIID4zCCAsugAwIBAgIJALwLp6+xV13iMA0GCSqGSIb3DQEBBQUAMIGHMQswCQYD
VQQGEwJERTEXMBUGA1UEBwwORnJhbmtmdXJ0L01haW4xEzARBgNVBAoMCkRaIEJB
OoD8y9uFwL24rdqR7lCAC5PdPYlf594yOwbUaIVfxBo46vnzmJO3 ...
-----END CERTIFICATE-----
Appendix C. Getting started with SSL certificates 187