Generating and testing SSL certificates

The best-known tool for generating certificates on Linux is part of the OpenSSL toolkit. Nearly every application that implements SSL/TLS, such as the Apache and Nginx HTTP servers, uses it.

A digital certificate, required for the asymmetric encryption used between an HTTP server and a client, can usually be obtained in two ways: create a self-signed certificate, whose authenticity is not guaranteed by a certificate authority; or create a CSR for a certificate authority to use when issuing a signed certificate whose authenticity it guarantees.

Command to create a CSR (Certificate Signing Request) ​

openssl req -new -newkey rsa:2048 -sha256 -nodes -keyout chave.key -out requisicao.csr

Keep the private key safe. If you lose it, you will not be able to use the certificate issued by your certificate authority.

Because of a Google Chrome update, generate certificates with the -sha256 parameter to avoid errors with SHA1 certificates, which have been rejected since November 2014.

Command to inspect the data entered in a CSR ​

openssl req -in requisicao.csr -noout -text

Command to create a CSR from an existing private key ​

openssl req -key chavePrivada.key -new -out requisicao.csr

Command to create a self-signed certificate ​

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout chavePrivada.key -out certificado.crt

Command to inspect a certificate ​

openssl x509 -in certificado.crt -text -noout

Command to remove a password from a private key ​

openssl rsa -in chave.key -out chavePrivadaSemSenha.key

Commands to compare the MD5 values of keys, CRTs, and CSRs ​

openssl x509 -noout -modulus -in certificado.crt | openssl md5openssl rsa -noout -modulus -in chave.key | openssl md5openssl req -noout -modulus -in requisicao.csr | openssl md5