How to Use the Command 'openssl req' (with examples)

The openssl req command is a versatile tool within the OpenSSL suite that is primarily used for managing PKCS#10 Certificate Signing Requests (CSRs). CSRs are crucial when you want to obtain an SSL certificate from a Certificate Authority (CA). The command can also be used to generate self-signed certificates, which can be useful for testing or internal usages. This level of flexibility makes openssl req a valuable utility for anyone working with digital certificates and secure connections.

Use Case 1: Generate a Certificate Signing Request to Be Sent to a Certificate Authority

Code:

openssl req -new -sha256 -key filename.key -out filename.csr

Motivation:

Generating a Certificate Signing Request (CSR) is a critical first step if you need to obtain an SSL certificate from a trusted Certificate Authority (CA). This is often necessary when you want to secure your web server or another type of network communication. The CSR contains information about your organization and domain, and upon successful validation, the CA issues a certificate. Organizations use this to ensure that their online transactions and data are encrypted and secure.

Explanation:

• openssl: This invokes the OpenSSL toolkit, which provides various cryptography functions.
• req: This specifies the command to manage certificate requests.
• -new: This flag indicates that a new CSR should be created.
• -sha256: This specifies the SHA256 hashing algorithm, which is widely used and secure.
• -key filename.key: This part specifies the file containing the existing private key associated with the CSR.
• -out filename.csr: This specifies the output file where the generated CSR will be stored.

Example output:

You will not see a direct output on the screen. Instead, the CSR is saved in the specified file (filename.csr). You can view its content using:

cat filename.csr

And you will see encoded data that looks something like this:

-----BEGIN CERTIFICATE REQUEST-----
MIIC ... [content truncated] ... wDQYJKoZIhvcNAQEBBQADggEBAG8b .........
-----END CERTIFICATE REQUEST-----

This data should be submitted to a CA for obtaining a digital certificate.

Use Case 2: Generate a Self-Signed Certificate and a Corresponding Key-Pair, Storing Both in a File

Code:

openssl req -new -x509 -newkey rsa:4096 -keyout filename.key -out filename.cert -subj "/C=XX/CN=foobar" -days 365

Motivation:

Self-signed certificates are perfect for testing purposes or for internal services where security is required but paying for a sign-off by a major CA is not justifiable. With a self-signed certificate, you act as your own CA, thus you’ll not have the widespread trust that comes with a commercially-signed certificate, but it does provide encryption. This method can be invaluable for organizations that need confidentiality in environments they entirely control.

Explanation:

• openssl: This calls the OpenSSL toolkit for various security tasks.
• req: Again, this denotes a request operation, specifically within the context of certificates.
• -new: Indicates creation of a new certificate.
• -x509: This flags the intention to generate a self-signed certificate rather than a CSR.
• -newkey rsa:4096: This creates a new RSA key of size 4096 bits, a standard size for secure cryptographic operations.
• -keyout filename.key: This specifies where the generated private key should be saved.
• -out filename.cert: This is the output file where the self-signed certificate will be saved.
• -subj "/C=XX/CN=foobar": This denotes the subject of the certificate, with C representing country code and CN the common name. Here, it’s a placeholder indicating an example. You should replace “XX” and “foobar” with your actual country code and domain or service name respectively.
• -days 365: This specifies the duration in days for which the certificate is valid. In this example, it’s valid for one year.

Example output:

Running this command may produce output information confirming the creation of the keys and certificate; notably, two files filename.key and filename.cert will be created in your working directory.

If you list the contents of filename.cert using:

cat filename.cert

You might find something like:

-----BEGIN CERTIFICATE-----
MIIF ... [content truncated] ... TkdA==
-----END CERTIFICATE-----

This is your self-signed certificate, ready to be deployed.

Conclusion:

The openssl req command is a powerful tool for creating Certificate Signing Requests, as well as self-signed certificates. Its flexibility and utility ensure that whether you’re working in a development environment needing test certificates, or preparing to secure a production server, OpenSSL provides the necessary functionality. Understanding each option and flag allows for an optimal use, meeting security needs effectively in various scenarios.