On this page, you will learn how to generate a new certificate signing request (CSR) using OpenSSL.

• Generate a CSR with a new RSA key pair
  • Linux/ Unix 
  • Windows
• Generate a CSR with an existing RSA key pair

Generate a CSR with a new RSA key pair

Linux/Unix

Step 1
Generate a new RSA key pair (e.g. 4096-bit) with openssl. In this case, the key is generated without a password (not recommended!).

openssl genrsa -out private.pem 4096

Better alternative for generating a key with a password:

openssl genrsa -aes128 -passout pass:<passwordgoeshere> -out private.pem 4096

Technischen Richtlinien des BSI and Cryptographic Key Length Recommedation provide more information on recommended keys lengths.

Schritt 2
Generate a new CSR with openssl (interactively):

openssl req -new -key private.pem -out request.pem

Please note the following attributes for the respective PKI. Use the exact spelling!

RFC conformity requires the presence of only one CN. All further FQDNs must be listed als Subject Alternative Names (subjectAltNames). You can achieve this with a single OpenSSL command under Unix/Linux:

for Harica PKI

openssl req -new -utf8 -key private_key.pem -out request.pem -batch -subj "/C=DE/ST=Nordrhein-Westfalen/O=RWTH Aachen University/CN=fqdn1.domain.rwth-aachen.de" -addext "subjectAltName=DNS:fqdn1.domain.rwth-aachen.de,DNS:fqdn2.domain.rwth-aachen.de"

for Sectigo PKI

openssl req -new -key private_key.pem -out request.pem -batch -subj "/C=DE/ST=Nordrhein-Westfalen/L=Aachen/O=RWTH Aachen University/CN=fqdn1.domain.rwth-aachen.de" -addext "subjectAltName=DNS:fqdn1.domain.rwth-aachen.de,DNS:fqdn2.domain.rwth-aachen.de"

for DFN-Verein Community PKI

openssl req -new -key private_key.pem -out request.pem -batch -subj "/C=DE/ST=Nordrhein-Westfalen/L=Aachen/O=RWTH Aachen/CN=fqdn1.domain.rwth-aachen.de" -addext "subjectAltName=DNS:fqdn1.domain.rwth-aachen.de,DNS:fqdn2.domain.rwth-aachen.de"

for DFN Grid-PKI

openssl req -new -key private_key.pem -out request.pem -batch -subj "/C=DE/O=GridGermany/OU=RWTH Aachen/CN=fqdn1.domain.rwth-aachen.de" -addext "subjectAltName=DNS:fqdn1.domain.rwth-aachen.de,DNS:fqdn2.domain.rwth-aachen.de"

Windows

Schritt 1
Create a csr.conf with the following information: (an example for Sectigo PKI):

• prompt = no
• distinguished_name = req_distinguished_name
• req_extensions = req_ext
• [req_distinguished_name]
  • C=DE
  • ST=Nordrhein-Westfalen
  • L=Aachen
  • O=RWTH Aachen University
  • CN=name1.domain.rwth-aachen.de
• [req_ext]
  • subjectAltName = @alt_names
• [alt_names]
  • DNS.1 = name1.domain.rwth-aachen.de
  • DNS.2 = name2.domain.rwth-aachen.de

Schritt 2
Enter the OpenSSL command:

openssl req -new -key private.pem -config csr.conf -out request.pem

Generate a CSR with an existing RSA key pair

It is not recommended (good practice) to reuse an RSA key pair.

If for technical reasons you need to do so (e.g. Key Pinning), then you generate a new Certificate Signing Request CSR (new_request.pem) based on the existing Certificate (cert.crt) and the associated private key file (private.pem), as follows:

openssl x509 -x509toreq -in cert.crt -signkey private.pem -out new_request.pem

Output the generated CSR in plain text:

openssl req -noout -text -in new_request.pem

Next steps:

• upload your CSR into the RA-Portal
• upload your CSR into the DFN-Verein Community PKI
• upload your CSR into the DFN Grid-PKI