How to Generate a CSR for an Apache or NGINX Web Server with OpenSSL

Generating the key pair

The utility “OpenSSL” is used to generate both Private Key (key) and Certificate Signing Request (CSR).

OpenSSL is usually installed under (/usr/local/ssl). If you have a custom install, you will need to adjust these instructions appropriately.

Note: Change mydomain.com to the website you wish to create the CSR for.

Browse to a folder where you like to generate your keypair. It is recommended to generate the keypair in a directory with locked down permissions (We recommend setting the permission to 600 on the private key).

Note: If you are using OpenSSL on Windows please navigate to your OpenSSL “bin” directory and open a command prompt

Type the following command at the prompt in OpenSSL (type openssl in unix systems):

genrsa –out www.mydomain.com.key 2048



Note: If you wish to use a passphrase with your private key you can include “-des3” in the command. You will then be prompted for a passphrase. Please keep the passphrase in a safe location as it cannot be recovered. If the passphrase is lost, you must generate a new keypair.

A 2048 RSA private key will be generated and stored in the file “www.mydomain.com.key”

Generating the CSR

Type the following command at the prompt in OpenSSL:
req –new –key www.mydomain.com.key –out www.mydomain.com.csr

Note: You will be prompted for the PEM Pass Phrase if you included the “-des3” command. Type it in now.

Note: There is a known issue with Apache/OpenSSL Windows-based installations. If you receive an error with the above command, please enter the following:

req -new -key www.mydomain.com.key -out www.mydomain.com.csr -config openssl.cnf

Input the information for the Certificate Signing Request. This information will be displayed in the certificate:

Common Name: Must match the URL you plan to secure exactly – is usually your fully-qualified domain name (e.g. trustzone.dk or mail.trustzone.dk). Remember the www. is important – include it if you want to secure https://www.mydomain.com & exclude it if you want to secure https://mydomain.com

Organization: The legal (officially registered) name of your organization/company include Inc., LLP., Pvt, Plc. Ltd. SARL., etc

Organizational unit: The name of your department within the organization (this is often “IT,” “Web,” or is just left blank)

City/locality: The city or town in which your organization is located

State/Province: The state in which your organization is located

Country: Click here for the official list of ISO country codes for this file

Note: Do NOT enter the following: “Email Address”; “A challenge password” or ”An optional company name”:

Please verify the CSR to ensure all information is correct. Use the following command:

req -noout -text -in www.mydomain.com.csr

The CSR will now be created and can be submitted via the website.

You are now ready to submit your CSR for the certificate you wish to install.