How to Generate a SSL/TLS Certificate Signing Request (CSR) on Debian 10

For any live website, SSL Certificates have become a key requirement. A Certificate Authority (CA) verifies and issue SSL certificates. There are two categories of these certificates:

  • Self-Signed certificates: As the name implies, these are the certificates that are signed by the identity creating it rather than by a trusted certificate authority. It is Mostly used in an intranet environment for trial and development purposes.
  • CA Certificates: These certificates are signed by a trusted CA (Certificate Authority) such as Verisign, DigiCert, GoDaddy, Thawte, etc.

To obtain a self-signed SSL certificate or the one signed by a certificate authority, you first have to create a certificate signing request (CSR). After the CSR is generated, it is then submitted to a certificate authority to acquire an SSL certificate. CSR is a block of encrypted text that contains all the information including the organization's name, country, city, email address, etc. required for the generation of an SSL certificate.

In this article, we will explain how to generate a CSR on a Linux server or desktop using the command line. We will use Debian 10 OS for describing the procedure mentioned in this article.

Getting Started

For generating CSR on a Debian OS, we will need OpenSSL tool. OpenSSL is an open-source tool widely used for generating a CSR. To check whether OpenSSL is installed or not, open the Terminal in your Debian OS and then type the below command:

$ dpkg -l |grep openssl

If it is already installed in your system, it will return the following results.

Check if OpenSSL is installed

Installing OpenSSL

If you do not see the above results, then you have to install OpenSSL as follows:

Enter the below command in the Terminal to switch to super user account.

$ su

Enter the required password. Then execute the below command to install OpenSSL.

$ apt-get install openssl

Install OpenSSL

Wait for a while until the installation of OpenSSL is completed.

Generating CSR

Run the following command to generate a private key and the CSR. The command syntax is as follows:

$ openssl req -new -newkey rsa:2048 -nodes -keyout domain.key -out domain.csr

Replace domain in the above command with your own domain name.

Enter a few details like Country name; State, Organization name, email address, etc. and make sure to enter the right information, as it will be later checked by a certificate authority.

Generate the CSR

Above command will generate a private key in the file domain.key and certificate request in the file domain.csr and save it in your current directory.

View and copy the contents of private key

You can view and store the private keys on your server that you may need later. However, the important thing is not to share it with anyone. Navigate to the directory where the key file is stored. Then run the below method in order to view the contents of the private key file:

$ cat domain.key

Replace domain in the above command with your own domain name.

To copy the contents of the private key file, select and copy the entire content including the “BEGIN PRIVATE KEY” and “END PRIVATE KEY” tags.

Private key

View and copy contents of CSR file

To obtain an SSL certificate, you will need to send the certificate request to a certificate signing authority by copy-pasting the entire content of CSR file.

To view the content of CSR file, navigate to the directory where the CSR file is stored. Then run the below method:

$ cat domain.csr

Replace domain in the above command with your own domain name.

To copy the contents of the CSR file, select and copy the entire content including the “BEGIN CERTIFICATE REQUEST” and “END CERTIFICATE REQUEST” tags.

CSR file

That was all you need to know about generating a certificate signing request (CSR) in a Debian 10 OS. Now you can get an SSL certificate from certificate signing authority by pasting the content of CSR file on the order form when enrolling for SSL certificate.