Certificate Signing Request (CSR)

This article has not been completed yet. However, it may already contain helpful Information and therefore it has been published at this stage.

CSR properties:

Common Name (CN)	The Fully Qualified Domain Name (FQDN). e.g. *.example.com, www.example.com, and mail.example.com.
Organization (O)	The legal name of your organization. Do not abbreviate and include any suffixes, such as Inc., Corp., or LLC.
Organizational Unit (OU)	The division of your organization handling the certificate.
City/Locality (L)	The city where your organization is located. This shouldn’t be abbreviated.
State/County/Region (S)	The state/region where your organization is located. This shouldn’t be abbreviated.
Country (C)	The two-letter code for the country where your organization is located.
Email Address	An email address used to contact your organization.

# Checking Version
openssl version -a

# Installing OpenSSL
sudo apt install openssl

# CSR - Creation
sudo openssl req -new -newkey rsa:2048 -nodes -keyout <key-file>.key -out <csr-file>.csr

# The command creats two files. (1) .key and (2) .cer.
# Remove "-nodes" in a production environment. It avoids key-encryption
# which is not recommended.

# CSR - Creation based on a Custom Config-File
sudo openssl req -new -newkey rsa:2048 -nodes -keyout <key-file>.key -out <csr-file>.csr -config server_cert.cnf

# The command creats two files. (1) .key and (2) .cer.
# Remove "-nodes" in a production environment. It avoids key-encryption
# which is not recommended.

# Config-File Creation
nano server_cert.cnf

# Content server_cert.cnf

[req_distinguished_name]
countryName                     = Country Name (2 letter code)
stateOrProvinceName             = State or Province Name (full name)
localityName                    = Locality Name (eg, city)
organizationalUnitName          = Organizational Unit Name (eg, section)
commonName                      = Common Name (eg, your name or your server\'s hostname)
emailAddress                    = Email Address

[req_ext]
subjectAltName = @alt_names

[alt_names]
IP.1 = <IP>
DNS.1 = <FQDN>

# CSR - Verification
openssl req -text -in <csr-file-name>.csr -noout -verify

References:

How To Create A Certificate Signing Request On A Linux Server?

Steps to generate CSR for SAN certificate with openssl | GoLinuxCloud

Step by step instruction to generate Certificate Signing Request (CSR) for Subject Alternative Name (SAN) certificates using openssl with examples in Linux

dernerlGoLinuxCloud