How To Generate SSL Key, CSR and Self Signed Certificate For Apache

If you want to convert your website from HTTP to HTTPS, you need to get a SSL certificate from a valid organization like Verisign, Quovadis, Thawte, etc. You can also generate self signed SSL certificate for testing purpose.

In this article, let us review how to generate private key file (server.key), certificate signing request file (server.csr) and webserver certificate file (server.crt) that can be used on Apache server with mod_ssl.

Key, CSR and CRT File Naming Convention

I typically like to name the files with the domain name of the HTTPS URL that will be using this certificate. This makes it easier to identify and maintain.

Instead of server.key, I use localhost.localdomain.key
Instead of server.crt, I use localhost.localdomain.crt

Generate Private Key on the Server Running Apache + mod_ssl

First, generate a private key on the Linux server that runs Apache webserver using openssl command as shown below.

[root@hercules ~]# openssl genrsa -des3 -out localhost.localdomain.key 2048
Generating RSA private key, 2048 bit long modulus
......................................+++
............................................................................................................................................................+++
e is 65537 (0x10001)
Enter pass phrase for localhost.localdomain.key:
Verifying - Enter pass phrase for localhost.localdomain.key:

That generates a 2048-bit RSA key pair, encrypts them with a password you provide, and writes them to a file. You need to next extract the public key file. You will use this, for instance, on your web server to encrypt content so that it can only be read with the private key..

Export the RSA Public Key to a File

The command to do that is

[root@hercules ~]# openssl rsa -in localhost.localdomain.key -outform PEM -pubout -out public.crt
Enter pass phrase for localhost.localdomain.key:
writing RSA key

The -pubout flag is really important. Be sure to include it.

Next open the public.crt and ensure that it starts with a -----BEGIN PUBLIC KEY-----. This is how you know that this file is the public key of the pair and not a private key.
To check the file from the command line you can use the less command, like this:

[root@hercules ~]# less public.crt

Visually Inspect Your Key Files

It is important to visually inspect you private and public key files to make sure that they are what you expect. OpenSSL will clearly explain the nature of the key block with a -----BEGIN RSA PRIVATE KEY----- or -----BEGIN PUBLIC KEY-----

You can use less to inspect each of your two files in turn:

less localhost.localdomain.key to verify that it starts with a -----BEGIN RSA PRIVATE KEY-----
less localhost.localdomain.crt to verify that it starts with a -----BEGIN PUBLIC KEY-----

The Generated Key Files

The generated files are base64-encoded encryption keys in plain text format. If you select a password for your private key, its file will be encrypted with your password. Be sure to remember this password or the key pair becomes useless.

The private key file looks something like this

The public key file looks somthing like

Protecting Your Keys

Depending on the nature of the information you will protect, it’s important to keep the private key backed up and secret. The public key can be distributed anywhere or embedded in your web application scripts, such as in your PHP, Ruby, or other scripts. Again, backup your keys!

Remember, if the key goes away the data encrypted to it is gone.Keeping a printed copy of the key material in a sealed envelope in a bank safety deposit box is a good way to protect important keys against loss due to fire or hard drive failure