How to create an SSL Certificate

I thought I might quickly throw up a small how-to on creating an SSL certificate. Any article you will find on my site that will walk you though any form on web platform (CMS, LMS, etc), I will always recommend that you use an SSL certificate on your website.

An SSL certificate consists of 3 parts. A private key, which is used to decrypt the actual certificate, the certificate itself, and in many cases you may also use a CSR (Certificate Signing Request).

The process of creating a certificate is as follows:

1. Create your private key

2. Create a Certificate Signing Request

3. Request an Official Certificate Authority to generate your certificate based on your CSR (Recommended), or you can create a self signed certificate.


The reason I recommend using an official certificate authority to sign your certificate is because your clients will need to trust the “Certificate Issuer”. If your user base is around 500 people for example, the last thing you want is having 500 people ringing you up to say “I don’t know what to do, it says it might be dangerous to trust this site”. Don’t forget that your CA won’t be listed as a trusted issuer by default.

My own advice here would be, use a real Certificate Authority. It will cost a bit of money, but it will help turn that frown upside down!.


So lets crack on with making your own certificate.

Start by creating your private key. In this situation, I’m going to make an SSL certificate for

[root@server01 ~]# openssl genrsa -des3 -out 1024
Generating RSA private key, 1024 bit long modulus
e is 65537 (0x10001)
Enter pass phrase for
Verifying - Enter pass phrase for
[root@server01 ~]#


Next, use your private key to create a CSR

[root@server01 ~]# openssl req -new -key -out
Enter pass phrase for
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [XX]:GB
State or Province Name (full name) []:London
Locality Name (eg, city) [Default City]:London
Organization Name (eg, company) [Default Company Ltd]:Example Inc
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []
Email Address []

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[root@server01 ~]#


At this point, you can then send your CSR ( ) to your chosen Certificate Authority, e.g. VeriSign, to complete the Certificate generation process.

If you wish to pursue using a self signed certifcate, use the below step.

[root@server01 ~]# openssl x509 -req -days 365 -in -signkey -out
Signature ok
subject=/C=GB/ST=London/L=London/O=Example Inc/
Getting Private key
Enter pass phrase for
[root@server01 ~]#

If you don’t get any errors in the above steps, then you should now have a file. You will need to use this in conjuction with your private key in order to set up an SSL service. E.g Apache


For those of you looking to use your newly created certificate with Apache, add the following lines to your virtual host definition in Apache.

SSLEngine on
SSLCertificateFile /etc/httpd/
SSLCertificateKeyFile /etc/httpd/

At this stage, when Apache starts, you will be asked for the pass-phrase of your certificate.


[root@server01 ~]# service httpd restart
Stopping httpd:                                            [  OK  ]
Starting httpd: Apache/2.2.15 mod_ssl/2.2.15 (Pass Phrase Dialog)
Some of your private key files are encrypted for security reasons.
In order to read them you have to provide the pass phrases.

Server (RSA)
Enter pass phrase:

OK: Pass Phrase Dialog successful.
[  OK  ]
[root@server01 ~]#

In order to restore the non-interactive service start process, you will need to remove the pass-phrase from the private key. This obviously has security concerns associated with it, so you will need to change the permissions of your certificate so that it can only be read by root.

To remove the pass-phrase, do the following.

[root@server01 ~]# mv /etc/httpd/{,orig}
[root@server01 ~]# openssl rsa -in /etc/httpd/ -out /etc/httpd/

Enter pass phrase for /etc/httpd/
writing RSA key
[root@server01 ~]# chmod 700 /etc/httpd/*
[root@server01 ~]# chown root:root /et/etc/httpd/*
[root@server01 ~]# service httpd restart
Stopping httpd:                                            [  OK  ]
Starting httpd:                                            [  OK  ]
[root@server01 ~]#


All done folks. As always, feel free to leave comments or contact me directly.

Leave a Reply

Your email address will not be published.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>