IBM TS4300

Generating a certicate signing request
The req command is used to generate a CSR. The most basic form of this command species the name
of the key le you created in the previous step and the name of the output le, which must have a *.csr
extension.
The following example also includes the -SHA256 option, which creates a certicate using the SHA256
signature algorithm.
• Windows
OpenSSL> req -new -key key-filename.pem -out cert.csr -SHA256
• Linux
$ openssl req -new -key key-filename.pem -out cert.csr -SHA256
When you enter the command, you will be prompted to provide the following information. This
information is used to create a distinguishing name (DN) for the certicate.
• The two-letter code for your country, such as US or DE
• The full name of your state or province
• Your city or town
• The name of your organization
• The name of the unit within your organization
• Your name or the host name of the system
• Your email address
• A challenge password – This is not related to the password you assigned when creating the private key.
Leave blank unless you understand when and how to use it.
• Company name – Optional
Generating a self-signed certicate
The req command is also used to generate a self-signed certicate. The output le should have a *.pem
extension.
• Windows
Openssl> req -new -x509 -key key-filename.pem -out selfcert.pem -SHA256
• Linux
$ openssl req -new -x509 -key key-filename.pem -out selfcert.pem -SHA256
Creating the certicate package
When you have the certicate, copy and paste the contents of the certicate le into the le containing
the private key. It should look something like the following (only much longer). The le must have a *.pem
extension.
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-256-CBC,F6F1F37584D8189C97F23F9DCD431B42
qwabUGR9ag09wq1nDtsB3hSuXtJdOBhEn3Wok6qrIWqE8VL8Ss5N7U4MNIWA4G9A ...
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIID4zCCAsugAwIBAgIJALwLp6+xV13iMA0GCSqGSIb3DQEBBQUAMIGHMQswCQYD
VQQGEwJERTEXMBUGA1UEBwwORnJhbmtmdXJ0L01haW4xEzARBgNVBAoMCkRaIEJB
OoD8y9uFwL24rdqR7lCAC5PdPYlf594yOwbUaIVfxBo46vnzmJO3 ...
-----END CERTIFICATE-----
IBM Condential
Appendix C. Getting started with SSL certicates187