Generate the private key and certificate signing request (CSR) together with OpenSSL, then submit only the CSR to your certificate authority (CA):
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
openssl req -new -newkey rsa:2048 -noenc
-keyout server.key -out server.csr
-subj "/C=US/ST=State/L=City/O=Example Org/CN=example.com"
-addext "subjectAltName=DNS:example.com"The command writes an unencrypted RSA private key to server.key and a PKCS#10 request to server.csr. Protect the key, verify both files locally, and send only server.csr for issuance.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What a CSR and private key do
A TLS certificate is issued for a public key and an identity such as a DNS name. OpenSSL creates the key pair locally: the private half remains on the server, while the public half is placed in the CSR. The CA signs a certificate after processing that request. The CSR does not contain the private key.
The server.key file is the private key used by the web server or application during TLS handshakes. Anyone who obtains it can impersonate the service covered by the issued certificate, so treat it as a secret. The server.csr file contains the requested subject, public key and request extensions. It is the file you upload or paste into the CA’s enrollment system.
OpenSSL describes req this way: “This command primarily creates and processes certificate requests (CSRs) in PKCS#10 format.”
Prepare the Linux server before generating files
Install and identify OpenSSL
OpenSSL must be installed on the server. Use the package manager for your Linux distribution, then confirm that the executable is available:
openssl versionThe exact package command depends on the distribution. Run the generation command from a directory where the account can create files but where unprivileged users cannot read them. A protected service key directory is preferable to a shared home or temporary directory.
Confirm the names and CA policy
Write down every fully qualified domain name that clients will use. Current TLS enrollment relies on the Subject Alternative Name (SAN) extension for hostname matching; do not assume that putting a name in Common Name (CN) is sufficient. Confirm the CA’s current rules for subject fields, allowed names and key algorithms before generating the request.
- Use the exact spelling and capitalization required by your service’s DNS names.
- Include each required DNS name in SAN, such as both the apex name and its
wwwname when both are served. - Request only names your organization controls and that the service actually needs.
- Check whether the CA requires particular country, state, locality or organization values.
Choose a safe working directory
Set a restrictive umask before creating the key, or create the destination directory with permissions that exclude other users. The key should ultimately be readable only by the account that runs the TLS service (and by root when administrative access is required). Avoid generating a production key in a world-readable directory and moving it later.
Generate a CSR and RSA private key in one command
Run the following after replacing the subject and SAN values with your own details:
Recommended Free Tools
openssl req -new -newkey rsa:2048 -noenc
-keyout server.key -out server.csr
-subj "/C=US/ST=State/L=City/O=Example Org/CN=example.com"
-addext "subjectAltName=DNS:example.com"This command is non-interactive and therefore repeatable for scripted provisioning. It creates two separate files:
server.key: a newly generated 2048-bit RSA private key.server.csr: a PKCS#10 certificate request containing the subject, public key and requested SAN.
Change the filenames when several services share a host; names such as api-example-com.key and api-example-com.csr reduce the risk of overwriting an unrelated request.
Understand every option
| Option | Purpose |
|---|---|
req |
Invokes OpenSSL’s certificate-request utility. |
-new |
Creates a new certificate request. |
-newkey rsa:2048 |
Generates a new 2048-bit RSA key for the request. |
-noenc |
Writes the private key without passphrase encryption, which is convenient for unattended service startup but increases the importance of filesystem and host protection. |
-keyout server.key |
Writes the private key to the named file. |
-out server.csr |
Writes the CSR to the named file. |
-subj |
Supplies the distinguished-name fields without interactive prompts. |
-addext |
Adds a request extension, here the SAN list. |
Because -noenc produces an unencrypted key, a person who can read the file can use it. If your operational policy requires an encrypted key, use the encryption behavior supported by your OpenSSL build and plan how the service will receive its passphrase at startup. Do not add encryption casually to a key that an existing daemon expects to open automatically.
Set the subject and Subject Alternative Names correctly
Distinguished-name fields
The value passed to -subj is a slash-delimited distinguished name. In the example, C is the country, ST the state or province, L the locality, O the organization and CN the common name. These fields describe the request; the CA may validate, normalize or restrict them according to its enrollment policy.
Use a CN that is meaningful for the primary name, but put every hostname clients will verify in SAN. A certificate request with CN=example.com and no SAN is incomplete for a service also accessed as www.example.com.
Add multiple DNS names directly
Separate DNS SAN entries with commas:
-addext "subjectAltName=DNS:example.com,DNS:www.example.com,DNS:api.example.com"Attach this option to the complete generation command. Do not put spaces after commas unless your OpenSSL syntax and CA policy explicitly allow them. Review the resulting extension rather than assuming the command was parsed as intended.
Use a configuration file for larger requests
A configuration file is easier to audit when a request contains several fields or extensions. Create a file such as server-req.cnf with the required request and SAN sections:
[ req ]
distinguished_name = req_distinguished_name
req_extensions = req_ext
prompt = no
[ req_distinguished_name ]
C = US
ST = State
L = City
O = Example Org
CN = example.com
[ req_ext ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = example.com
DNS.2 = www.example.com
DNS.3 = api.example.comGenerate from that file with:
openssl req -new -newkey rsa:2048 -noenc
-keyout server.key -out server.csr
-config server-req.cnf -reqexts req_extKeep the configuration file with the request records if you need to demonstrate exactly which names were requested. It is not a secret, but it can reveal internal hostnames, so store it according to your organization’s information-handling rules.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →When SAN values are not DNS names
This workflow focuses on DNS identities. Other identity types require the corresponding OpenSSL extension syntax and must be accepted by the CA. Do not substitute an IP address, email address or other value into a DNS: entry; use the type required by the CA’s enrollment documentation.
Protect the private key immediately
- Restrict the file after creation:
chmod 600 server.key. - Place it in the service’s protected key directory, preserving ownership expected by the web server or application.
- Do not email, upload or paste
server.keyinto a CA portal, ticket or support mailbox. - Record where the key is stored and who is authorized to retrieve it.
- Back it up only through an approved encrypted backup process; an unprotected copy defeats the original permission setting.
Do not overwrite an existing production key simply because the filename is convenient. Generate a new, distinct filename during rotation, keep the currently deployed key available for rollback, and document when the service will switch to the replacement.
Verify the CSR before you submit it
Inspect the complete request and cryptographically verify its signature:
openssl req -in server.csr -noout -text -verifyIn the output, check all of the following:
- The subject fields match the CA enrollment form and your service record.
- The public-key algorithm is the one your policy and CA support.
- The requested SAN extension lists every required DNS name and no unintended name.
- The request signature verifies successfully.
- The file is the newly generated CSR, not an older request with a similar filename.
The -text option makes the fields readable, -verify checks the CSR signature and -noout suppresses a second PEM dump. A successful verification does not mean the CA will issue a certificate; it confirms that the request is internally consistent.
Check the private key
Run OpenSSL’s key consistency check:
openssl pkey -in server.key -check -nooutResolve any error before submission. Also check the operating-system permissions and ownership with your normal file-management tools. If the key check succeeds but the service cannot read the file later, the cause is usually ownership, directory traversal permission, a mandatory access-control rule or a wrong path rather than a defective key.
Confirm the key and CSR belong together
The CSR contains the public key corresponding to the private key. If you generated the files in separate operations or copied one from another host, compare their public-key material before requesting issuance. A certificate issued from a CSR that does not match the installed private key will not work when the service starts.
Submit the request and install the issued certificate
- Submit only
server.csrthrough the CA’s current enrollment process. - Complete any domain-control or organizational validation the CA requires.
- Download the issued certificate and any intermediate chain supplied for your server software.
- Install the certificate, chain and the already protected
server.keyusing the web server or application documentation for that product. - Reload or restart the service according to its documented procedure, then test the endpoint from a client.
The CA uses the CSR to issue the certificate; it has no reason to receive your private key. Keep the original CSR and issuance records so a later administrator can identify which names and public key were requested.
RSA or an elliptic-curve key?
The command above uses RSA because it is a broadly documented example. An elliptic-curve key can also be appropriate, but there is no single algorithm that is correct for every CA, client population or operational policy. Make the choice against the systems that will terminate TLS, the CA’s accepted algorithms and your organization’s security standard.
| Decision factor | Questions to answer |
|---|---|
| CA compatibility | Does the selected CA accept the key type and parameters for this certificate profile? |
| Application compatibility | Can every server, load balancer, library and client that will use the certificate handle that algorithm? |
| Security policy | Does your organization’s policy mandate or restrict a particular key family? |
| Performance | Have you considered the handshake and resource characteristics for your actual workload rather than assuming one family is always faster? |
| Operational support | Can your monitoring, backup, rotation and incident-response procedures manage the selected key type? |
Document the decision with the request. If compatibility is uncertain, confirm it with the CA and the software vendors before replacing a working production key.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common failures and how to recover
The command says OpenSSL is missing
Install the OpenSSL package supplied for your Linux distribution, then rerun openssl version. If several installations exist, ensure the executable in your service environment is the one you intend to use.
The CSR has the wrong hostname
Stop before submitting it. Correct the -subj or configuration file, regenerate with a new filename, and inspect the SAN output again. Editing a CSR after creation is not a substitute for generating a correct request.
SAN is absent from the decoded request
Confirm that -addext was included in the command, or that the configuration file names the request-extension section and that -reqexts req_ext selects it. Regenerate and rerun the inspection command; do not rely on the command line displayed in shell history alone.
Free tools Windows power users keep installed
One-click scans. No signup required.
The CA asks for a CSR but someone requests the key
Provide the CSR only. A legitimate issuance workflow does not require the private key. If a key was disclosed, treat it as compromised, generate a replacement pair and request a new certificate using the replacement CSR.
The service will not start after installation
Check that the certificate matches the private key, the service account can traverse the key directory and read the key, and the certificate and intermediate chain are in the paths configured by the application. Review the service’s error log for a precise permission, format or chain error before changing files.
A renewal would overwrite the live key
Use a separate key and CSR filename, validate the new certificate in a staging or parallel configuration when possible, then switch the service deliberately. Keep the old key and certificate until rollback is no longer needed and your retention policy permits removal.
Quick Recap
Production checklist
- OpenSSL is installed and the intended executable responds to
openssl version. - All service DNS names and the CA’s subject requirements are documented.
- The CSR includes every required SAN entry.
- The private key is stored with restrictive permissions and is not shared with the CA.
openssl req -in server.csr -noout -text -verifysucceeds and shows the expected subject, algorithm and SAN.openssl pkey -in server.key -check -nooutsucceeds.- The issued certificate, chain and private key are installed according to the server software’s instructions.
- Rotation, backup and rollback ownership is recorded for the next administrator.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems
